Grok’s “anyone with the link” default left 35,578 apps open to the internet

Describe an app in a chat window, click Publish, and Grok builds it — then hands it a public address. Security firm Claroc spent November 8 working through a list of those addresses. Of the 37,571 Grok apps still online, 35,578 opened for anyone on the public internet, no sign-in required. Roughly one in ten held sensitive material, and about 2 percent held material serious enough to rate high or critical.

The exposure is not a hack. It is the product working as designed: every published app gets its own address under grok.me, the address lands in passive DNS the first time anyone opens it, and the publish panel preselects "Anyone with the link." Claroc calls such pages GhostShares — they open for people who were never given the link, and those people can find them on their own. The same trick exposed Meta's Muse chats a month earlier.

How a link becomes a public index#

On Grok, the link is the hostname: every published app gets its own address, <name>.grok.me. When someone opens one, their computer asks a DNS resolver where that name lives — and passive DNS services collect those lookups and make them searchable by pattern. The first time the people a link was meant for use it, the name lands in a commercial index.

Grok proposes four random words for each address, and about half the names Claroc saw were exactly that. Nobody would guess one, and nobody needs to: the dataset lists them. Claroc found 43,601 names under grok.me, tried 43,551, and found 37,571 still online. Of those, 35,578 — 94.7 percent — opened for anyone. Only 1,993 answered with an access error, the response an app set to "Only you" or "Invited users" returns.

The default is what makes the finding a story rather than a curiosity. When Claroc clicked Share on an app ChatGPT built, access was set to "Only me" until changed; Claude's published artifacts put the secret in the URL path, so DNS never sees it. Other builders — Lovable, Replit, Base44, Google AI Studio, Meta's Muse — also give each app its own hostname, but the default decides whether a listed address opens.

What was inside — including SpaceXSI's own data#

The most striking part of the haul belonged to the company that makes Grok. Claroc found 24 open apps built by SpaceXSI and X staff: a confidential onboarding plan for a new member of the enterprise sales team, a sales territory map of 594 strategic accounts, eight X advertising proposals and media plans — one to a U.S. federal agency, marked confidential — four live advertiser account boards, one tracking progress toward a $1.6 million sales goal, seven campaign reports for advertisers in Brazil, Japan, Korea and Thailand, and two copies of an X brand safety playbook.

Beyond SpaceXSI and X, Claroc identified internal data from 30 organizations it could name from the material itself: 26 have more than 1,000 employees, six are in the Fortune 500, 18 are based in the United States and 12 in 11 other countries. Claroc estimated 650 to 800 apps in total hold private data, after an AI model flagged candidates and researchers read the flagged apps by hand.

The hand-confirmed examples show how far the exposure reaches past corporate decks: a hospital group's staff event app with a searchable roster of more than 3,500 employees; an intensive care briefing for a single patient, listing labs, imaging and ventilator status; a cruise ship's galley checklist naming crew by full name and employee ID; a fire department's live shift board; a trucking firm's driver-recruiting list of more than a thousand people; and a contractor's timesheet whose code, downloaded by every visitor's browser, held 18 employee accounts with passwords in plain text, admins included.

Open didn't just mean readable#

Claroc did not sign in to, submit forms to, or modify anyone else's app. To test whether open apps could also be changed, it built two apps of its own with made-up data. The first was a contact list Grok was asked to save "so every visitor sees them." It got a database and no sign-in; from an incognito window, Claroc added a row the next visitor saw.

The second was a customer list "for my company's sales team of 4 people." Grok added sign-in on its own, through "Continue with Google" and "Continue with X." But the code Grok wrote adds whoever signs in to the team before it checks whether they are on it, so the check always passes. An uninvited Google account signed in, saw every customer, changed one record and deleted another.

The controls exist and work when switched on. With "Only you" selected, the first app answered 401 to a stranger, and unpublishing the second took its address offline within seconds. They are not the default, and nothing prompts the builder to use them. "AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone," Asaf Aprozper of Claroc Research said.

SpaceXSI's answer, and the four fixes Claroc asked for#

Claroc reported the issue to SpaceXSI on November 8, through the address in its security.txt file, with the counts, the two test apps and four proposed fixes, and offered to share the full list of app addresses privately. It reported the other 22 staff apps on November 9. On November 10, SpaceXSI answered a reporter's questions but had not replied directly to Claroc's report. It took down the 24 apps its staff had built — but not the apps other Grok users and organizations left open. Because SpaceXSI did not say it would reach the app owners, Claroc began notifying the affected organizations itself; three had been emailed by publication.

SpaceXSI's position is that Grok apps are private until their creator chooses to share one, and that publishing takes several steps, including choosing between "Only you" and "Anyone with the link" and accepting a legal disclaimer; employee accounts are set to "Only you" by default. Claroc's answer is that extra clicks on a path ending with access already set to everyone do not protect the data — the people who published the 35,578 open apps went through every one of those steps, and the 24 staff apps were open despite the employee default.

The four fixes Claroc sent with its report: serve shared apps on a hard-to-guess path under one host, so the link never becomes a DNS name; add an "everyone in my organization" option limited to the company's email domain; make "Only you" the default and show who can open the app before it goes live; and warn at publish time when an app has a database and no sign-in, building an invite list instead when a request describes a team.

What to watch#

The first question is whether SpaceXSI changes the default — it already uses "Only you" for employee accounts. The second is notification: SpaceXSI holds the full list of app addresses and can reach every owner, but its response did not say it would, so the cleanup depends on Claroc finding security contacts organization by organization. The third is whether the rest of the app-builder market moves — the hostname pattern is industry-wide, and the fix Claroc wants is already how ChatGPT and Claude handle the equivalent feature.

This is also the second privacy finding for Grok Build this year. In July, a researcher showed the command-line version of the tool uploading users' entire Git repositories, including full history and committed secrets, to company cloud storage; xAI stopped the uploads server-side within a day and later open-sourced the tool. The flaws are different, but the shape is the same: a tool built for speed, with a default that sends more than its users expected.

If you build apps with Grok, the check takes minutes: open each published app's access setting and switch anything holding internal data to "Invited users" or "Only you," test it from an incognito window, and search the scripts the app loads for names, emails and passwords. Unpublish anything nobody owns.