35,578 Open Grok Build Apps: What Claroc Measured and What SpaceXSI Disputes

By investus Research · Published November 12, 2026 (KST) · Informational only, not investment advice

A security research firm says it opened 35,578 apps built with Grok Build, SpaceXSI's chat-to-app feature, without signing in to anything. Among them were 24 apps made by SpaceXSI and X staff, including a confidential onboarding plan for a new enterprise sales hire and a sales territory map of 594 accounts. SpaceXSI took those 24 staff apps down after the report. As of the published research and the press coverage we reviewed, there was no public confirmation that the default sharing setting for ordinary users had changed.

The report is "GhostShares 2," published by Claroc (Asaf Aprozper, Claroc Research) on November 10, 2026. Ars Technica's senior security editor Dan Goodin covered it the same day (4:12 p.m. PT, which is 09:12 KST on November 11). It quickly became one of the most-discussed Grok stories on X on November 11, appearing as an X trending news story ("Grok Build Privacy Flaw Exposes Thousands of Apps and Sensitive Data") and drawing replies from security accounts and from Grok's own account.

Below we separate what Claroc measured, what SpaceXSI and Cursor said, and the open questions.

What Grok Build is, in one paragraph

Grok Build is the mode inside Grok where a user describes an app in the chat and Grok writes it. When the user publishes, the app gets its own web address in the form `<name>.grok.me`. Grok suggests a name made of random "dice words," which is meant to make the address hard to guess. SpaceXSI is the name of the merged SpaceX and xAI, as Ars describes it. Ars also describes Cursor as the AI coding service SpaceXSI recently acquired, and it was a Cursor representative who answered Ars's questions.

What Claroc says it measured

These are Claroc's own figures from its November 10 post:

| Measure | Figure (Claroc) |

|---|---|

| App names listed under grok.me (methodology) | 43,601 |

| App addresses tried (summary) | 43,551 |

| Still online when tried | 37,571 |

| Opened for anyone, no sign-in | 35,578 (94.7% of online apps) |

| Returned HTTP 401 (set to Only you or Invited users) | 1,993 (5.3%) |

| Open apps built by SpaceXSI and X staff | 24 |

| Other organizations identifiable from open apps | 30 (26 with 1,000+ employees; 6 in the Fortune 500) |

| Estimated apps holding private data | roughly 650 to 800 (Claroc estimate from sampling) |

Two notes on those numbers. First, Claroc's post uses 43,601 in its methodology section and 43,551 in its summary; we flag the 50-name gap and lean on the online/open pair, which is internally consistent. Second, the 650 to 800 figure is an estimate. Claroc says an AI model flagged pages that looked private, the team checked flagged apps by hand, and it compared the model against a random sample. That is a model-based estimate, not a hand count.

Claroc says most open apps were games, landing pages and calculators; it estimates about 1 in 10 held sensitive data and roughly 2% held high or critical material.

How the links became findable

On Grok Build, the secret part of the link is the hostname itself. The first time anyone opens `<random-words>.grok.me`, their computer performs a DNS lookup for that name. Passive DNS services record such lookups and let account holders search them by pattern. Claroc says it found the app names using common subdomain discovery techniques, and Ars reports Aprozper said a passive DNS search returned 43,601 links ending in grok.me.

Ars contrasts this with link designs where the random part sits in the path after the domain (for example, Google Docs links). DNS never sees a path. Claroc lists Claude's published artifacts, ChatGPT's shared conversations and Gemini's shared chats as path-based.

Claroc does not claim Grok is alone here. It says Lovable, Replit, Base44, Google AI Studio, Meta's Muse and ChatGPT's published apps also give each app its own hostname, and v0 and Bolt deploy to hostnames too. Ars quotes Aprozper: those builders "also give each app its own web address, so the same DNS records expose them, too. However, Grok is where we found by far the most sensitive company data."

The disputed point: what the default really is

This is where the two sides diverge, and both versions deserve to be stated plainly.

Claroc's observation (its own test account). Building works on the free plan; in Claroc's account, publishing needed a paid plan. Nothing went public until the builder clicked Publish. When it did, the access panel offered "Anyone with the link," "Invited users" and "Only you," with "Anyone with the link" already selected.

SpaceXSI / Cursor's statement. The Cursor representative told Ars that Grok Build "apps are private by default and nothing goes public unless the creator chooses to share it." Per Claroc's summary of SpaceXSI's answers to a reporter, publishing takes several steps (Publish, choose an address, Publish again, choose access, accept a legal disclaimer, Publish a final time), and employee accounts are set to "Only you" by default.

Where they agree. Both say nothing is public before the builder clicks Publish. The disagreement is over the access step that follows. Claroc's argument is that extra clicks do not help if the path ends with "everyone" preselected, noting the people behind the 35,578 open apps went through every step. Ars says the representative did not answer follow-up questions, including about notifying other users.

We treat the "Anyone with the link" preselection as Claroc's documented observation in its account, not as a confirmed universal setting for every account type. We treat "private by default" as SpaceXSI/Cursor's statement. Neither is our finding.

What Claroc proved about writing and deleting data

Claroc built two apps of its own with made-up data. In one, a public contact list, Grok created a database with no sign-in, and an anonymous visitor could add a row the next visitor saw. In the other, a "team" customer list, Grok added Google and X sign-in, but according to Claroc the generated code added whoever signed in to the team before checking membership. An uninvited Google account read every record, changed one and deleted another.

Claroc is explicit that it proved write and delete only on its own two apps and did not sign in to, write to or test anyone else's. So the claim that some open third-party apps may also be editable is an inference from the test design, not a demonstrated fact about any specific app.

Timeline (as reported)

- November 8, 2026: Claroc reports the issue to SpaceXSI via its security.txt address and flags two SpaceXSI/X apps.

- November 9: Claroc reports the other 22 staff apps.

- November 10: SpaceXSI answers a reporter's questions; per Claroc it had not replied to Claroc's report. Ars reports SpaceXSI began removing the 24 links within hours of Ars's email, and they returned "app not found" by publication. Claroc publishes "GhostShares 2," without hostnames, and begins notifying affected organizations itself; by publication it had emailed three.

- November 11 (KST): The story trends on X. In our check of public posts through about 18:00 KST, we found no SpaceXSI announcement of a platform-wide default change.

- November 12 (KST): In a re-check before publication, Claroc's figures and the Ars Technica reporting were unchanged, and we found no SpaceXSI announcement of a default-setting change.

Why this matters beyond one bug report

For readers who track Musk's companies, the interest is not the leak alone. It is what the episode says about SpaceXSI's push into business software.

Claroc's list of four proposed fixes reads like an enterprise checklist: keep app secrets out of DNS, add an "everyone in my organization" option tied to the company's email domain, make "Only you" the default with a clear preview of who can open an app, and warn at publish when an app has a database and no sign-in. Claroc notes that SpaceXSI already uses "Only you" as the default for its own employees.

As Claroc frames it, a sales territory map and a lunch poll get the same publish button, with no IT review. Whether SpaceXSI changes the default for ordinary users, and how fast, is a concrete test of how it balances that speed against the security expectations of the companies it wants as customers.

Open questions to watch

1. Does SpaceXSI publicly change the default access setting for non-employee accounts?

2. Does it notify owners of the other open apps, or offer an organization-only sharing option?

3. Does it move app links off per-app hostnames, as Claroc and Ars suggest?

We will update this analysis only with verified statements or measurements.

Sources

1. Claroc, "GhostShares 2: Grok Apps Exposed xAI's Business Secrets and People's Private Data," Asaf Aprozper, November 10, 2026. https://blog.claroc.io/ghostshares-grok-build-apps/ (retrieved November 11, 2026)

2. Ars Technica, Dan Goodin, "Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI," November 10, 2026, 4:12 p.m. PT. https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/ (retrieved November 11, 2026)

3. X trending news story, "Grok Build Privacy Flaw Exposes Thousands of Apps and Sensitive Data," updated November 11, 2026, 05:32 UTC. https://x.com/i/trending/2120330231362031958 (retrieved November 11, 2026; an X summary of posts, used only as evidence of discussion, not as a fact source)

This article is for information only. It is not investment advice and does not recommend buying or selling any security. investus Research does not hold the app addresses discussed and did not access any third-party app.