Updated

Security firm Claroc found more than 35,000 public Grok Build apps exposing confidential data, including material belonging to SpaceXSI, Ars Technica reported on November 10, 2026. Grok Build is a vibe-coding agent from SpaceXSI, the merged SpaceX and xAI, that turns text or speech into apps shared by link. Claroc said a passive DNS search found 43,601 grok.me links, and more than 35,000 opened the app and all its stored data to anyone who clicked. Exposed material included internal business plans, ad proposals, medical exam results, cruise line galley checklists, and employee names and ID numbers. Twenty-four SpaceXSI apps leaked items such as a confidential onboarding plan, a sales territory map of 594 accounts, and internal sales tool addresses. Other affected users include Fortune 500 companies and a defense contractor. The random words in the links sit left of the domain, unlike Google's design, so passive DNS records make them easy to enumerate. Aprozper said Grok sets links to anyone with the link by default. Claroc notified SpaceXSI on Sunday without reply, then a Claroc official tagged Musk and Grok Manager Matt Palmer on X. After Ars Technica emailed questions, SpaceXSI began removing links, and by publication all 24 of its apps returned an "app not found" error. A Cursor representative, which SpaceXSI recently acquired, said Grok Build apps are private by default, a claim Aprozper's tests contradicted. Claroc is notifying affected companies, and the luxury cruise company's security team is working to contain the exposure.