Claroc finds 35,000 open Grok Build apps exposing confidential data

Security researchers from Claroc report that Grok Build, an AI coding agent developed by SpaceXSI, has inadvertently exposed thousands of private applications to the public internet. The findings highlight significant gaps in how the platform handles data privacy for its users.The findings highlight significant gaps in how the platform handles data privacy for its users.The findings highlight significant gaps in how the platform handles data privacy for its users.

The evidence

Claroc discovered that Grok Build users can share their created apps via unique URLs. Although the platform randomises these links to restrict access, a design flaw allows anyone to enumerate and view thousands of live projects. Clicking these links reveals all associated data without requiring authentication.

The research firm found that the exposed content includes highly sensitive material. This ranges from internal business plans and advertising proposals to medical examination results and employee identification numbers. Some of the leaked data belonged to Fortune 500 companies and a defence contractor.reported

Notably, Claroc identified 24 apps built by SpaceXSI itself that were publicly accessible.reported These applications contained confidential documents such as an onboarding plan for a new enterprise sales team member. They also included a sales territory map covering 594 accounts and internal system addresses for sales tools.

The decision

SpaceXSI began removing the links to its own exposed applications shortly after Ars Technica emailed the company with questions. By the time Ars Technica published its report, all 24 SpaceXSI apps returned an “app not found” error when accessed.reported

The broader population of 35,000 exposed apps remained accessible at the time of publication.reported Claroc noted that the company responsible for Grok had its own internal materials open to anyone holding the link. This contrasts with traditional software tools that would typically require company sign-in.

What to make of it

Claroc expressed shock that a company would have its internal material open to the public via simple links. The firm highlighted that if the sales team had purchased a conventional tool, the data would have sat behind authentication. Building the tool with AI resulted in it going live open to anyone with the link.

This incident suggests that AI-generated applications may inherit different security postures than traditional software. The ease of creation and deployment appears to bypass standard access controls. Users may not realise their shared links are enumerable and thus publicly readable.

In practice

Startup founders using Grok Build should assume any shared application link is potentially public. The platform’s design allows enumeration of live projects, meaning randomised URLs do not guarantee privacy. Users must verify that sensitive data is not included in shared apps or that access controls are explicitly enforced.

Current access limitations mean that clicking a link reveals all associated data. There is no indication of a fix for the 35,000 non-SpaceXSI apps.reported Founders should audit their shared links and remove sensitive information immediately to prevent further exposure.