Grok Build: more than 35,000 AI-built apps could be opened without signing in

Security firm Claroc found, according to Ars Technica, that shareable links from Grok Build expose the data of more than 35,000 apps, including internal SpaceXSI material.

Grok Build, a tool in which people have AI build a finished app, leaves thousands of the apps it creates openly accessible, according to security firm Claroc. Ars Technica and other outlets reported the finding on 11 November 2026. Per secondary reports, Claroc opened 35,578 apps without signing in and estimates that several hundred of them held private data.

Where is the problem? A shared app link puts its random words on the left side of the address, in the subdomain. Reports say such addresses show up in passive DNS services, which log domain lookups, so the links can be found by listing them. Services that place the random string after the domain do not leak this way. According to the researchers, exposed data included sales plans, staff rosters and medical exam records.

The apps included 24 belonging to SpaceXSI and X staff, which were taken down after disclosure. The sharing defaults are disputed: Claroc says the paid account preselected "Anyone with the link", while SpaceXSI reportedly says employee accounts default to "Only you". We found no independent confirmation of either version.

The underlying trap is familiar: a tool that builds an app in minutes and offers a share link makes every employee a publishing decision-maker. If someone pastes customer data into such an app, it is the same problem as any other leak of personal data under GDPR.