Grok Build’s app-sharing links exposed sensitive user information—and its own maker wasn’t spared, according to Ars Technica. Security firm Claroc found more than 35,000 publicly accessible apps, including 24 containing internal material from SpaceXSI, the company behind the AI coding tool. An awkward demonstration of the company’s own product. Source
Ars reports that SpaceXSI began removing its links within hours of receiving the publication’s questions. By the time Ars published its report, all 24 identified company apps returned an “app not found” error, while almost all other exposed data remained available. Source
The secret was in the address
Grok Build lets users create apps through text or speech and share them through generated web addresses. According to Ars, randomized words sit in each address’s subdomain, before grok.me, to make the full hostname difficult to guess. Source
The catch: those hostnames can appear in searchable passive DNS records, which collect observed domain-name lookups. Claroc found app addresses there instead of guessing the random words. The supposedly obscure address had acquired a directory listing. Source
Finding an address isn’t the same as bypassing a login. According to Ars’s account of Claroc’s research, the discovered links generally opened the apps and their associated data to anyone holding the URL. Source
Medical records and sales plans
The reported findings included an occupational-health dashboard containing 3,784 worker medical examinations at a Peruvian construction company and a healthcare-company app listing about 3,565 employees by name and ID. Claroc also found confidential business proposals and other internal records, Ars reports. Source
SpaceXSI’s own exposed material reportedly included a confidential sales-team onboarding plan, a territory map covering 594 accounts, internal tool addresses and advertising proposals. Source
The defaults are disputed
A representative for Cursor, the coding service Ars says SpaceXSI recently acquired, told the publication that Grok Build “apps are private by default and nothing goes public unless the creator chooses to share it.” Source
In tests reported by Claroc co-founder and CTO Asaf Aprozper, sharing links defaulted to “Anyone with the link,” and users had to switch to a restricted option. Source
Ars reports options for restricting access to invited users or the creator. If you’re building an internal tool, check those permissions rather than trust an obscure address. Source
The Cursor representative did not answer Ars’s follow-up questions about the removal of internal material or whether affected customers would be notified. Ars did not report evidence of malicious access or data theft. “Anyone with the link” is a risky home for an onboarding plan when the link itself isn’t much of a secret. Source
Comments