SpaceXSI’s Grok Build flaw turned 35,000 internal apps public

How 35,000 Grok Build apps became public

Claroc, a security firm, found that SpaceXSI’s Grok Build AI-coding agent exposed over 35,000 user-built apps to the public. The apps included internal documents, patient records, passwords, and government-related data. Only one of the exposed apps required a password.

The flaw was built into Grok Build’s design. Each published app received a subdomain like random-words.grok.me. Passive DNS services logged these subdomains after the first visit, making them discoverable through public databases. Unlike competitors such as Google’s Gemini or Meta’s Muse—which hide access tokens in URL paths—SpaceXSI placed the identifier in the subdomain itself, exposing it to scanning tools.

Claroc tested 37,571 published apps and found 94.7%—35,578—were open without sign-in. Between 650 and 800 of these contained sensitive or personal data. Exposed records included ICU patient briefings, a hospital’s 3,500-employee roster, a fire department shift schedule, and plaintext passwords in a contractor’s timesheet app.

Internal apps leaked alongside customer data

SpaceXSI and X employees were among the hardest hit. Twenty-four internal apps—including a sales territory map of 594 strategic accounts, eight confidential advertising proposals, and an onboarding plan—were publicly accessible. One ad proposal, marked "confidential," targeted a U.S. federal agency.

SpaceXSI removed its 24 exposed apps after Claroc tagged executives on X. However, it left thousands of other open apps untouched. The company stated that publishing requires multiple steps, including a legal notice, and that employee accounts default to "Only you." Claroc countered that the final publish screen still preselects "Anyone with the link," and even the stricter employee setting failed to prevent exposure.

A coding flaw and slow response worsened the breach

Claroc’s tests revealed another flaw: Grok Build’s default code granted access to any Google-authenticated user before verifying team membership. In one test, an outside account could read, edit, and delete records in a team customer list. When set to "Only you," the same app correctly blocked outside access.

Claroc recommended three fixes: make "Only you" the default setting, move shared apps to hard-to-guess paths instead of subdomains, and warn builders when an app includes a database without login protection. SpaceXSI has not implemented these changes.

The firm is now notifying affected organizations directly, as thousands of apps remain publicly accessible.

Regulators are watching, and this isn’t the first breach

The breach arrives as regulators sharpen their focus on AI tools. Ireland’s Data Protection Commission is already investigating X—SpaceXSI’s social platform—over sexualized deepfakes allegedly generated by Grok. The probe centers on whether the company neglected "data protection by design" in its tooling.

This is not SpaceXSI’s first privacy stumble. In August 2025, Forbes reported that Google Search indexed over 370,000 shared Grok conversations, exposing sensitive user data. In July 2026, Grok Build’s terminal tool uploaded entire Git repositories—including SSH keys and password databases—to xAI servers without user consent.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This breach shows how default sharing settings and predictable link structures can turn AI-powered app builders into unintended public repositories. Founders must treat every AI-generated link as a potential exposure point—especially if the tool assigns subdomains instead of random paths. Regulators are already watching; companies that fail to lock down defaults may face investigations, fines, or loss of enterprise trust.

Key takeaways

• Teams using AI-coding agents must disable public sharing by default and enforce mandatory login for any app handling internal data.
• Companies should audit their app-link generation patterns for DNS exposure and shift to random paths instead of predictable subdomains.
• Boards of affected firms—including six Fortune 500 companies—must prepare for regulatory inquiries and potential reputational damage.
• Incident response protocols for AI-generated apps need to extend beyond internal tools; third-party apps built on the same platform may remain exposed even after the vendor acts.

Related on Lazyfounder

• xAI
• More technology news