35,000 Grok Build apps were open to anyone, including SpaceXSI's own sales secrets

The company that makes Grok Build left its own sales secrets open to anyone with a link. So did about 35,000 of its users.

What happened

Security firm Claroc pulled 43,551 app addresses under grok.me, where Grok Build publishes the apps people vibe-code with it. Of the 37,571 still online, 35,578 (94.7%) opened for anyone, no sign-in needed. The catch: the random words that make each link hard to guess sit in the subdomain, so every new app shows up in public passive DNS records. In Claroc's tests, hitting Publish proposed 'Anyone with the link' as the access setting.

The damage

Most open apps were games and calculators, but Claroc estimates roughly 650 to 800 held private data. It confirmed a hospital group's roster of more than 3,500 staff, one ICU patient's labs and ventilator status, a cruise galley checklist with crew names and IDs, and a timesheet whose code held every employee's password in plain text. Twenty-four apps were built by SpaceXSI and X staff themselves, including a confidential onboarding plan and a sales territory map of 594 accounts.

How it was caught, and what happened next

Claroc reported it on 8 November and heard nothing back. SpaceXSI pulled its own 24 apps within hours of a reporter's questions, but other users' open apps stayed up. Cursor, which SpaceXSI acquired, says apps are private by default; Claroc's tests say otherwise.