Picture a small business owner who builds a staff scheduling app by typing a few sentences into a chatbot. No code, no servers, no security team. She clicks share, copies the link, and sends it to her team. She never imagines the link itself is sitting in a public record book, waiting for anyone to find it.
That is exactly what happened to tens of thousands of Grok Build users. The vibe-coding tool comes from SpaceXSI, the merged SpaceX and xAI. According to Ars Technica, researchers found more than 35,000 apps built with it were open to anyone online, no password required. Some held medical records, employee rosters, and business plans.
The worst part? The company that runs the tool had its own secrets in the pile. Its sales plans, its onboarding documents, and its territory maps were all sitting there too.
How the Grok Build Leak Happened
The story starts with a security firm called Claroc. Its co-founder and chief technology officer, Asaf Aprozper, was curious about how Grok Build share links actually worked. When you build an app with Grok Build, you can share it through a link. The link looks random, built from a string of everyday words.
A typical address might read like cinder-crane-sand-frost.grok.me. The idea is simple. Nobody can guess the address, so only people who receive the link can open the app. It is the same logic behind an unlisted video or a shared document.
But there was a flaw in where the randomness lived. The random words sat in the hostname, the part of the address to the left of grok.me. And hostnames are not secret. Every time someone visits a website, the address is recorded in passive DNS databases, giant logs that anyone can search.
Aprozper ran one such search. It returned 43,601 links ending in grok.me. Of those, 37,571 were still online. And 35,578 of them, or 94.7 percent, opened the app and all of its stored data with no sign-in at all. Only 1,993 returned an access-denied error.
What the Grok Build Leak Exposed
The numbers are striking, but the contents are worse. Claroc sampled the open apps and found a cross-section of real life: internal business plans, advertising proposals, medical exam results, and staff rosters with names and ID numbers.
One app held a Tesla service-centre scorecard naming 22 technicians, complete with productivity figures and bonus status. Another held 3,784 worker medical exams from a Peruvian construction company. A third was a load board for an explosives building at a plant in the United States run by a Norwegian-Finnish defence group.
There was more: a roster of 108 people on a Navy logistics support contract, a hospital staff app listing roughly 3,565 employees by name and ID, galley checklists from a celebrity cruise line, and a confidential proposal from a US data centre provider to a European carrier.
Claroc estimated that about one in ten open apps held sensitive business or personal data, and roughly 650 to 800 held private data outright. The firm is still contacting the companies involved. After Aprozper briefed a luxury cruise company’s security chief, the executive pulled in the whole security team within minutes.
SpaceX’s Own Secrets Were in the Open
Perhaps the most embarrassing detail is that the leak caught the platform’s own maker. Claroc found 24 apps built by staff at SpaceXSI and X, the companies behind Grok Build. They included a confidential onboarding plan for a new member of the enterprise sales team and a sales territory map covering 594 accounts.
There were also internal addresses for the sales team’s tools and advertising proposals, including one pitched to a US federal agency. The company that makes Grok had its own internal material open to anyone holding the link, and it had never been given to them by anyone outside.
Claroc reported the problem to SpaceXSI through the address in its security.txt file on Sunday, November 8. It sent details of the other 22 staff apps the next day. By Monday evening, all 24 were still exposed.
SpaceXSI began removing the links only within hours of Ars Technica emailing questions about the story. By the time the report was published, the links returned an “app not found” error. The other users’ apps were a different story. Nearly all of the data Claroc found remained available.
Why the Share Links Were Never Really Private
The flaw is not that the links were random. It is that the randomness was placed where the internet can see it. Passive DNS is a public record of which addresses exist and who has looked them up. Putting a secret in the hostname is like writing a safe combination on the front door.
Other platforms learned this lesson years ago. Google Docs, Claude’s published artifacts, ChatGPT’s shared conversations, and Gemini shares all keep the secret part of the link in the path, the section after the domain name. DNS never sees the path, so it never leaks.
Grok Build did it the other way around. Claroc says its tests also found that the publish panel pre-selected public sharing, which means many users may have shared their apps without realising how widely they could be found. How long the apps were listed, or whether anyone downloaded the data, is still unknown.
The Company Says Apps Are Private by Default
SpaceXSI has pushed back on the framing. A representative for Cursor, the AI coding service recently acquired by SpaceXSI, told Ars Technica that Grok Build apps “are private by default and nothing goes public unless the creator chooses to share it.”
The apps were not hacked. Nobody broke a password or slipped past a firewall. They were simply listed in a public record, and the links opened for anyone who clicked them. Security experts have long warned that an unlisted link is not the same as a private one. A link is only as secret as the places it appears.
This is the second privacy problem for Grok Build this year. In July, researcher Cereblab found that the Grok Build command-line tool was uploading users’ entire code repositories, including Git history and any secrets committed to them, to a Google Cloud Storage bucket. The company stopped that behaviour within about a day through a server-side switch.
What Happens Next for Grok Build Users
The immediate question is what SpaceXSI does now. The company pulled its own exposed apps quickly once reporters got involved, but tens of thousands of other users’ apps were still open at publication. A real fix would mean moving the secret part of each share link into the path, where DNS cannot see it.
Users have work to do as well. Anyone who has shared a Grok Build app should check what data it holds and whether it is still reachable. If an app contains employee records, customer details, or business plans, take it down or rebuild it with proper access controls until the platform changes how sharing works.
What This Means for Vibe Coding
The Grok Build leak lands at a moment when vibe coding is exploding. Tools that turn plain-language prompts into working apps have put software building in the hands of people who have never written a line of code. That is genuinely exciting, and it is also genuinely risky.
When a professional developer ships an app, security is part of the job. When a shop owner, a teacher, or a hospital administrator builds one by chatting with an AI, security is invisible. They trust the tool to handle the parts they cannot see. This week showed what happens when that trust is misplaced.
The broader pattern is familiar. Earlier this year, another major AI platform’s breach exposed customer datasets and model weights, as we covered in our report on the Fireworks AI breach.
And the industry’s answer to runaway AI systems has increasingly been a kill switch, like the OpenAI Control Room we wrote about this week. The tools are getting more powerful faster than the guardrails around them.
For now, the lesson is simple and old-fashioned: a link is not a lock. If your app holds anything you would not post on a noticeboard, do not trust a random-looking address to protect it.
The Grok Build leak proved that, 35,000 times over. For more on how AI companies handle your data, see our report on Google’s Gemini privacy changes.
Source: MLQ report on the Claroc research, originally reported by Ars Technica.
