Grok Build was designed to make building and sharing apps fast. But researchers at security firm Claroc say that convenience turned into a broad data exposure, leaving thousands of apps — and the business information inside them — reachable by anyone who obtained their links.¹

The problem began with Grok Build’s link-sharing architecture. The service used randomly generated “dice words” in subdomains such as cinder-crane-sand-frost.grok.me, intended to make URLs difficult to guess. Yet because that random element appeared before the domain rather than in the URL path, passive-DNS databases could catalog the addresses. Claroc said a search found 43,601 grok.me links, with more than 35,000 opening publicly accessible apps.¹

Among the exposed material were medical exam records, employee rosters, sales data, customer proposals and information tied to a defense contractor. The finding was especially awkward for SpaceXSI: Claroc identified 24 apps apparently created by the company itself, including advertising proposals, sales-territory information and a document marked as a confidential onboarding plan. “We were shocked,” the firm said, arguing that internal material had been available “to anyone holding the link.”¹

Timeline: On Monday evening, Claroc found all 24 SpaceXSI apps exposing information. After Ars Technica sent questions, SpaceXSI began removing the links within hours; by publication, those apps returned “app not found” errors.¹ A separate report likewise said the company did not immediately respond to a request for comment.²

SpaceXSI’s position, relayed by a Cursor representative, is that “apps are private by default and nothing goes public unless the creator chooses to share it.” Claroc’s tests directly challenge that account: researchers said Grok Build defaulted to “Anyone with the link,” requiring users to actively switch to “invited users” or “only you.”¹

The episode is a warning beyond one product. Other AI app builders also create web addresses that may be exposed through DNS, Claroc said, though Grok Build was where it found the most sensitive corporate data. For users, the immediate lesson is blunt: a shareable link is not the same thing as access control.¹