Ars Technica reported on 10 November that security firm Claroc found more than 35,000 publicly accessible Grok Build app links among 43,601 it identified. Opening a link gave access to the app and its stored data. Grok Build is SpaceXSI’s coding agent for creating apps from text or speech.
Claroc found the links through passive DNS services, which capture DNS lookups for previously unseen addresses. Grok Build puts randomly generated words before grok.me in each address, where those services can capture them, rather than in the path after the domain.
Claroc found 24 SpaceXSI apps containing internal material, including a confidential sales onboarding plan and a territory map covering 594 accounts. Other exposed records included medical exam results and employee names and ID numbers.
Asaf Aprozper, Claroc’s co-founder and CTO, said Grok Build set links to “Anyone with the link” by default in his tests. A Cursor representative said the apps were private by default unless their creators chose to share them. SpaceXSI began removing its links within hours of questions from Ars Technica. All 24 returned an “app not found” error when its report was published.
