More than 35,000 apps built with Grok Build, SpaceXSI’s AI app builder, were sitting open on the public internet — no sign-in needed — including SpaceXSI’s own confidential sales plans and other organizations’ medical and employee records. Security firm Claroc published the findings on November 10 in a report it calls “GhostShares 2,” and Ars Technica reported them the same day. Why it matters: anyone who builds internal tools with AI app builders needs to check what their share settings actually do, because a link nobody was sent turned out to be a link anybody could find.
November 11, 2026
What Claroc found
Claroc collected 43,601 app addresses under grok.me, the domain where Grok publishes apps people build by describing them in chat, and tried 43,551 of them. Of the 37,571 still online, 35,578 — 94.7% — opened for anyone, with no sign-in. Only 1,993 (5.3%) refused, the response an app gives when it is set to “Only you” or “Invited users.” Most of the open apps were harmless games, landing pages and calculators, but Claroc estimates about 1 in 10 held sensitive material, and puts the total with private data at roughly 650 to 800 apps. Those figures and examples are Claroc’s, from its own report.
How an unguessable link got found anyway
Every published Grok app gets its own hostname, usually four random words in front of grok.me. Nobody could guess one — and nobody had to. The first time a recipient opens the app, their computer’s DNS lookup puts that hostname into passive DNS databases, which anyone with an account can search by pattern. One search lists the names, and every name is a working link. Claroc contrasts this with shared chats on Claude, ChatGPT and Gemini, where the secret part of the link sits in the URL path and DNS never sees it, and with ChatGPT’s published apps, which start out set to “Only me” — so even when a hostname surfaces, the app itself stays shut.
What was inside — including SpaceXSI’s own data
Claroc found 24 open apps built by SpaceXSI and X staff: a confidential onboarding plan for a new enterprise sales hire listing internal system addresses, tools and 19 internal chat channels; a sales territory map covering 594 strategic accounts and their pipeline; eight X advertising proposals and media plans, one to a U.S. federal agency and marked confidential; four live advertiser boards with campaign spend, one tracking progress toward a $1.6 million sales goal; and seven campaign reports for advertisers in Brazil, Japan, Korea and Thailand. Beyond SpaceXSI, Claroc identified internal data from 30 other organizations — 26 with more than 1,000 employees, six of them Fortune 500 companies. Hand-confirmed examples include a hospital group’s staff roster of more than 3,500 employees, an intensive care briefing for a single patient with labs, imaging and ventilator status, a fire department’s live shift board with names and badge numbers, and a contractor’s timesheet app whose code held 18 accounts with plain-text passwords, admins included. Ars Technica’s reporting adds a Tesla service-center scorecard naming 22 technicians and 3,784 worker medical exams from a Peruvian construction company.
The default is the argument
Testing on two apps of its own, Claroc found the publish panel in its paid account offered “Anyone with the link,” “Invited users” and “Only you” — with “Anyone with the link” already selected. A team app Grok built for Claroc added Google sign-in, but the code added whoever signed in to the team before checking membership, so an uninvited Google account could read, edit and delete customer records. SpaceXSI, answering a reporter’s questions, said Grok apps are private until their creator chooses to share one, that publishing takes several steps, and that employee accounts default to “Only you.” Claroc reported the problem to SpaceXSI on November 8 and 9 and says it got no reply; SpaceXSI took down its own 24 apps within hours of Ars Technica emailing questions — by publication they returned an “app not found” error — but did not do the same for other users’ apps, and Claroc has begun notifying affected organizations itself.
Why it matters
This was not a hack, and that is the point. AI app builders turn publishing into a few clicks inside a chat window, often by people whose job is a sales territory or a shift roster, not IT. When the preselected audience is “anyone with the link” and the link is discoverable by design, internal data ends up public without anyone making an obvious mistake. If your team builds with Grok Build — or any AI app builder — search for your apps from an incognito window, set anything internal to “Invited users” or “Only you,” and remember that unpublishing a Grok app takes it offline at once. Claroc’s proposed fixes for SpaceXSI are equally plain: put the secret in the URL path instead of the hostname, and make “Only you” the default for everyone, not just employees. Everything AI, tested — and in this case, the test result every builder should read is that a share link is not access control.
Frequently asked questions
Were the Grok Build apps hacked?
No. Claroc opened each app once from the public internet, signed in to nothing. The apps were reachable because they were published with “Anyone with the link” access and their hostnames could be listed through passive DNS records.
How many Grok apps were exposed?
Claroc tried 43,551 grok.me addresses; 37,571 were online and 35,578 (94.7%) opened without sign-in. Claroc estimates roughly 650 to 800 of them held private data.
Is my own Grok Build app at risk?
If it is published with “Anyone with the link” access and holds anything internal, treat it as public. Switch it to “Invited users” or “Only you,” or unpublish it — Claroc confirms unpublishing takes a grok.me app offline immediately.
What has SpaceXSI done about it?
SpaceXSI removed its own 24 staff apps after Ars Technica asked about them, and says apps are private until a creator chooses to share. It has not, per Claroc, taken down other users’ open apps or announced a change to the default access setting.
Sources: Claroc Research (“GhostShares 2,” November 10, 2026), Ars Technica, MadRobot, Unite.AI