Claroc says 35,578 of the 37,571 Grok Build apps still online when it checked them opened with no sign-in. The apps are published under grok.me by Grok, the assistant from SpaceXSI, the company formed from the merger of SpaceX and xAI. Twenty-four of the open apps were built by SpaceXSI and X staff, and they held confidential sales material, including a territory map of 594 accounts.
Claroc published the findings on 10 November in a report it calls GhostShares 2. Ars Technica reported the same research that day.
“We were shocked. The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it.”
— Claroc, in its GhostShares 2 report
Claroc listed 43,601 names under grok.me and tried 43,551 addresses. Of those still online, 94.7% opened for anyone; 1,993, or 5.3%, returned the access error associated with the “Only you” or “Invited users” settings.
Each published Grok app gets its own hostname, typically a few random words ahead of grok.me. Claroc says those names can appear in commercial passive DNS indexes once someone opens the app, because a visit triggers a DNS lookup. It contrasts that with shared chats from Claude, ChatGPT and Gemini, where the unguessable part of the link sits in the path, which DNS doesn’t see. Other app builders, including ChatGPT’s published apps, Lovable, Replit and Bolt, also give each app its own hostname, the firm says. “Grok is where we found by far the most sensitive company data,” Asaf Aprozper, Claroc’s co-founder and CTO, told Ars Technica.
SpaceXSI told a reporter that Grok apps stay private until the creator chooses to share one, that publishing takes several steps including a legal disclaimer, and that employee accounts are set to “Only you” by default. A representative of Cursor, the coding service SpaceXSI recently acquired, told Ars Technica that Grok Build “apps are private by default and nothing goes public unless the creator chooses to share it.”
Claroc agrees nothing goes public before the builder clicks Publish. In the paid account it used, though, the publish panel already had “Anyone with the link” selected, with “Invited users” and “Only you” as the other options. “Extra clicks on a path that ends with access already set to everyone do not protect the data,” it wrote. The 24 staff apps were open even so.
Most of the open apps were games, landing pages and calculators. Claroc estimates about 1 in 10 held sensitive, internal or personal data, and that roughly 2% were serious enough to rate high or critical. Checking its model against a sample the firm read itself puts the total at roughly 650 to 800 apps with private data.
Besides SpaceXSI and X, Claroc identified internal data from 30 organisations: 26 with more than 1,000 employees, six of them in the Fortune 500, across construction, energy, technology, healthcare, transport, travel, defence and other sectors. It doesn’t name those organisations in its post.
Ars Technica, citing Claroc, describes some of the exposures in more detail: an occupational-health dashboard with 3,784 worker medical exams at a Peruvian construction company; a Tesla service-centre scorecard naming 22 technicians; a roster of 108 people on a US Navy logistics support contract; and a hospital staff app with about 3,565 employees. Among the SpaceXSI and X staff apps, Claroc lists the confidential sales onboarding plan, the 594-account territory map, eight X advertising proposals including one to a US federal agency marked confidential, and live advertiser boards. It also describes an intensive care briefing for a single patient, and a timesheet whose code held employee passwords in plain text.
Claroc built two apps of its own, with made-up data, to test the defaults. The first, a contact list, got a database and no sign-in; from an incognito window the researchers could add a row that the next visitor saw. The second, described as a customer list for a four-person sales team, added Google and X sign-in, but Claroc says the code Grok wrote added whoever signed in to the team before checking whether they belonged, so an uninvited Google account could read, change and delete records. It says it proved this only on those two apps, and didn’t sign in to or write to anyone else’s.
Claroc reported the issue to SpaceXSI on 8 November, at the address in its security.txt, and sent details of the remaining staff apps on 9 November. It offered to share the full list of addresses privately so SpaceXSI could reach the owners. Ars Technica says the 24 SpaceXSI apps were still exposed on the evening of 9 November, and that SpaceXSI began removing the links within a few hours of Ars sending questions. By the time Ars published on 10 November, those 24 links returned an “app not found” error. Claroc says SpaceXSI had not replied to its own report, had not taken down other users’ open apps, and had not said it would reach those owners, so the firm began notifying the affected organisations itself.
With the report, Claroc asked SpaceXSI to serve shared apps on a hard-to-guess path under one host, to make “Only you” the default, to add an option limited to a company’s email domain, and to warn at publish when an app has a database and no sign-in. There’s been no public confirmation that those changes have been made.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
