Research says Grok Build share links exposed thousands of apps

In short: Security researchers say Grok Build’s app sharing links made it easy to find and open tens of thousands of user projects, exposing sensitive data.

What happened

A security firm called Claroc reported that Grok Build, a tool from SpaceXSI that helps people build simple apps using AI, was unintentionally leaking private information from many users. Claroc said it found 43,601 Grok Build links, and more than 35,000 of them opened to anyone who clicked.

Grok Build lets creators share an app through a web link. The link is supposed to be hard to guess, like a long “secret handshake” URL that only people you send it to can use. Claroc says a design choice made those links discoverable, because the random part of the link sits before “grok.me,” which can show up in public internet lookup records.

Claroc said exposed content included internal business plans, sales documents, ad proposals, medical exam results, employee rosters, and other sensitive records. The report also found 24 apps made by SpaceXSI itself with confidential material, including an onboarding plan and sales territory details. After Ars Technica contacted SpaceXSI with questions, those 24 apps reportedly began returning “app not found.”

A representative tied to Cursor, an AI coding service SpaceXSI acquired, told Ars Technica that apps are private by default and only become public if the creator shares them. Claroc said its tests showed the default sharing option was “Anyone with the link,” and users had to change it to restrict access.

Why it matters

This is a reminder that “anyone with the link” can end up meaning “anyone who knows how to look,” especially at work. If people use tools like Grok Build to quickly make internal apps, they may accidentally publish staff names, health details, or confidential plans, the digital equivalent of leaving a folder on a park bench.

Source: Arstechnica