Grok Build builds apps from a text or voice prompt and lets users share them by link. The address includes a few random words so it cannot be guessed, but according to Claroc the random part sits in the domain name (before grok.me) rather than in the path, as in Google's share links. That means the addresses are recorded in passive DNS databases that can be searched. Such a search returned 43,601 links, and more than 35,000 of them, nearly 95%, opened without any sign-in.
According to Ars Technica, the exposed data included internal business plans, ad proposals, medical test results, a cruise line's work checklists and employee names and ID numbers, including from Fortune 500 companies and a defense contractor. Twenty-four of the apps belong to SpaceXSI itself, among them a confidential onboarding plan for a salesperson and a sales territory map with 594 accounts. Claroc notified SpaceXSI on Sunday, and the links to the 24 apps were removed only after Ars contacted the company. Most of the other data was still available at the time of publication.
A representative of Cursor, which SpaceXSI acquired, said apps are private by default, but Claroc's tests found the default sharing setting is "anyone with the link". Claroc notes that Lovable, Bolt and Replit also give each app its own address and are exposed to the same method. What to do: review apps shared from Grok Build and set sharing to invited users only, unless the app is meant to be public.