Security firm Claroc has revealed that 35,578 apps built with Grok Build, the vibe-coding agent from SpaceXSI (the company formed by the merger of SpaceX and xAI), were open on the internet to anyone, with no sign-in required. The findings, published on November 10, 2026 in the report "GhostShares 2" and reported by Ars Technica, included internal material from the very company that builds Grok: 24 apps created by SpaceXSI and X staff exposed sales plans, advertising proposals and a commercial territory map.
Claroc listed 43,601 addresses under the grok.me domain, where Grok publishes the apps users create by describing what they want in chat. Of the 43,551 addresses tested, 37,571 were still online — and 35,578 of them, or 94.7%, opened without asking for a login. Only 1,993 returned the 401 error typical of apps set to "Only you" or "Invited users".
What was exposed
Most of the open apps were games, calculators and simple pages. But about 1 in 10 held sensitive material, and Claroc estimates that 650 to 800 apps held private data serious enough to rate high or critical. Among the cases confirmed by hand:
- an app from a hospital group with a roster of more than 3,500 employees;
- an intensive-care briefing for a single patient, with lab results, imaging and ventilator status;
- a trucking firm's driver-recruiting list with more than a thousand people, with legal names and personal email addresses;
- a fire department's live shift board, with names, badge numbers and duty hours;
- a contractor's timesheet app whose code held the plain-text passwords of 18 employee accounts, including administrators.
Beyond SpaceXSI and X, the research identified internal data from 30 organizations — 26 with more than 1,000 employees, six of them in the Fortune 500 — in sectors including healthcare, construction, energy, technology, transport and defense. Claroc named none of them.
Even SpaceXSI itself was hit
The 24 apps built by SpaceXSI and X staff included a confidential onboarding plan for a new member of the enterprise sales team, a territory map of 594 strategic accounts, eight X advertising proposals — one of them to a U.S. federal agency, marked confidential — four live advertiser account boards, seven campaign reports and two copies of X's brand safety playbook. Only one of the 24 asked for a password.
Claroc notified SpaceXSI on November 8, through the address in the company's security.txt file, and reported the other 22 apps on November 9. With no reply, a company official tagged Elon Musk and Grok manager Matt Palmer on X. The 24 apps were still exposed on the evening of Monday, November 9; SpaceXSI began taking them down within hours of Ars Technica sending questions, and by the time the story was published, all of them returned an "app not found" error. The apps of other users, however, remained online, according to Claroc.
Why the links were not secret
Every app published in Grok Build gets its own address, made of four random words before grok.me. The idea was that the address would be impossible to guess. The problem, according to Claroc, is that the words sit to the left of the domain: when someone opens an app, their computer asks a DNS resolver for it, and passive DNS services record those lookups in databases anyone with an account can search by pattern. A single search for *.grok.me listed tens of thousands of addresses.
Other services handle this differently: Claude's published artifacts, ChatGPT's shared conversations and Gemini's shares keep the secret part of the link in the URL path, which DNS never sees. And when ChatGPT publishes apps, access starts as "Only me" until the creator changes it — the default does the protecting, Claroc says. In Grok Build, the research found, the publish panel came with "Anyone with the link" already selected in the paid account tested.
A second problem: a login that never blocks anyone
Claroc also built two apps of its own to test Grok's defaults. In the second, a customer list for a four-person sales team, Grok added Google and X sign-in on its own — but wrote the verification code so that anyone who signed in was added to the team before the check ran, so the check always passed. A Google account that was not the owner's and had never been invited signed in, saw every customer, changed one record and deleted another. The test was done only on Claroc's own apps.
What SpaceXSI says
To the press, SpaceXSI said Grok apps are private until their creator chooses to share them, that publishing takes several steps, and that employee accounts already start with the "Only you" default. Claroc replied that it agrees nothing goes live before the Publish click — but that the 35,578 open apps went through every one of those steps, and that extra clicks on a path that ends with access already set to "everyone" do not protect the data.
The security firm sent SpaceXSI four suggested fixes: serve shared apps on a hard-to-guess path under a single host, add an access option restricted to the company's email domain, make "Only you" the default, and warn at publish time when an app has a database and no sign-in. This is the second time Claroc has found this leak pattern: last month, the same kind of exposure — dubbed GhostShares — was identified in Meta's Muse.
Featured image: the Grok logo, from xAI, in the public domain, via Wikimedia Commons.
Sources: Claroc — "GhostShares 2: Grok Apps Exposed xAI's Business Secrets and Private Data"; Engadget — "A Grok vibe-coding agent leaked sensitive SpaceXSI data", based on Ars Technica's reporting; discussion on Threads.
This article was produced with the help of artificial intelligence, based on cross-checking public posts on X and sources on the internet, and reviewed against the original sources cited. Please consult the original sources to confirm the details.
By Muse
