Grok Build GhostShares: 35,578 Apps Open to Anyone

The short answer: yes, Grok Build exposed private data, and on a large scale. On 10 November 2026 the security firm Claroc published its research. Of 37,571 Grok apps still online under grok.me, 35,578, or 94.7%, opened for anyone with no sign-in at all. Some of them held internal material from SpaceXSI, the company that makes Grok. If you have built and published an app with Grok Build, check its sharing setting today.

This post covers what happened, why a random-looking link did not protect anything, and what to do about it. It draws on Claroc’s write-up and on Ars Technica’s report from the same day.

What Grok Build is

Grok Build is the mode in Grok where you describe an app in the chat and Grok writes it. Click Publish and the app goes live at its own address, in the form name.grok.me, with four random words that Grok suggests. SpaceXSI is the name of the merged SpaceX and xAI. If the idea of an AI that builds things for you is new, AI agent builders explained covers the category.

What was exposed

Claroc opened the first page of each app it found once, from the public internet, signed in to nothing. Most open apps were games, landing pages and calculators. About one in ten held something sensitive, and Claroc estimates roughly 650 to 800 apps held private data. Among the ones it confirmed by hand:

• —a hospital group’s staff app with a searchable roster of more than 3,500 employees,
• —an intensive care briefing for a single patient, with lab results and imaging,
• —a contractor’s timesheet whose code held every employee’s password in plain text,
• —24 apps built by SpaceXSI and X staff, including a confidential onboarding plan, a sales territory map of 594 accounts and advertising proposals, one of them to a US federal agency.

Claroc reported the issue to SpaceXSI on 8 November. SpaceXSI took down its own 24 apps; Ars Technica says the links started disappearing within hours of its questions. Claroc says the open apps belonging to other users and organisations stayed up. It names none of those organisations and says it is contacting them itself.

A link nobody can guess is not the same as a link nobody can find.

What GhostShares are

GhostShares is Claroc’s name for shared pages that open for people who were never given the link. The model behind share links is called capability-based security: holding an unguessable link is the permission. That works for as long as the link stays secret.

On Grok Build it does not, because of where the random part sits. It is in the hostname, to the left of grok.me. When anyone opens the address, their computer asks DNS where that name lives. Passive DNS services collect those lookups and let subscribers search them, so one search for names ending in grok.me returns the list. Nobody has to guess anything. Claude’s published artifacts and shared chats in ChatGPT and Gemini put the secret part in the path, after the slash, which DNS never sees.

This is a pattern rather than a one-off. In October Claroc described the same problem in Meta’s Muse; what else Muse does with your data is in Is Meta Muse safe. In August 2025 Fortune reported that more than 370,000 shared Grok conversations had turned up in Google search. And in July 2026 The Next Web reported that Grok Build was uploading whole Git repositories, secrets included, to xAI’s cloud.

What SpaceXSI says, and where Claroc disagrees

SpaceXSI says Grok apps are private until their creator chooses to share one, that publishing takes several steps, and that employee accounts default to Only you. A representative of Cursor, which SpaceXSI acquired, told Ars Technica that nothing goes public unless the creator chooses to share it.

Claroc agrees that nothing goes live before Publish. Its point is the step after. In the paid account it tested with, the access panel offered three options, Anyone with the link, Invited users and Only you, and Anyone with the link was already selected. Accept what is proposed and the app is open to everyone holding the address. Whether every account behaves the same way cannot be checked from outside. What is on record is that the people behind 35,578 apps ended up there.

The second finding is arguably worse. Claroc asked Grok for a customer list “for my company’s sales team of 4 people”. Grok added Google sign-in on its own, but its code checked who you were, not whether you were on the team. A Google account that had never been invited could see every customer, change one record and delete another. Claroc tested this only on its own apps.

Grok is not the only builder with this shape. Claroc says Lovable, Replit, Bolt and others also give each app its own hostname. Grok is simply where it found by far the most sensitive company data.

What to do now

1. 01List the Grok apps you have published. Anything holding internal notes, customer data or names should be set to Invited users or Only you.
2. 02Check from outside. Open the address in a private window, signed in to nothing. If you do not get an error page, neither will a stranger.
3. 03Try signing in with an account that should not have access. If it gets in, the app needs a list of who may use it.
4. 04Keep passwords and keys out of the code. Anything the browser downloads, every visitor can read.
5. 05Unpublish what nobody needs. Claroc says a grok.me app goes offline as soon as you do.
6. 06If it was built for work, tell IT. Nobody can protect a tool they do not know exists.

The lesson that is not about Grok

An AI builder makes what you ask for in minutes, and what you did not ask for is what goes missing. Grok has the right settings; they just are not the default. The more precisely you state the requirement, “only these four people, nobody else”, the more likely it is to be in the result. How to write a prompt that works first time shows what a precise request looks like. Then test the result instead of trusting it, the habit covered in checking an AI answer when you are not the expert. For an AI that acts on your behalf, the same questions come up in Is Claude Duet safe.

Coursium is an iOS app for learning to use AI at work, with courses such as ChatGPT Essentials and Claude Essentials. It practises writing a clear instruction and checking the output before you pass it on. It does not cover Grok Build, and a course is not a substitute for a security review by your IT team. You can see the approach on the Coursium home page or try the free practice example.