Follow us on Google News
A major security and privacy lapse has been uncovered in Grok Build, the artificial intelligence coding platform operated by Elon Musk’s company SpaceX, exposing more than 35,000 web applications to the public internet without requiring any login or authentication. According to an investigation by cybersecurity firm Claroc, researchers identified 43,601 app addresses hosted under the grok.me domain, of which 37,571 were online during testing. Of those active applications, 35,578, or roughly 94.7 percent, could be accessed openly by anyone with the web address, while only 1,993 restricted access. Among the exposed pages were 24 applications created by employees of SpaceX and social media platform X, containing confidential enterprise sales plans, internal chat channel directories, data on 594 strategic clients, and a confidential advertising proposal prepared for a US federal government agency.
Internal Corporate Data and Medical Records Exposed
Claroc’s analysis revealed that the 24 applications built by SpaceX and X staff included a confidential onboarding plan for new enterprise sales personnel, listing internal system addresses, sales tools, and 19 internal chat channels. Investigators also found eight advertising proposals and media plans linked to X’s ad business, four live advertising dashboards displaying campaign spending, and advertiser reports covering Brazil, Japan, South Korea, and Thailand. Claroc co-founder and chief technology officer Assaf Aprosper expressed surprise that internal data from the company behind Grok was accessible through links requiring no credentials. Beyond corporate files, Claroc estimated that roughly one in ten public applications contained sensitive business or personal information, identifying between 650 and 800 apps with private data. These included duty rosters for more than 3,500 hospital group staff, an intensive care unit patient briefing with lab results and ventilator status, a fire department live shift dashboard with badge numbers, and plain-text account passwords for 18 workers inside a contractor’s timesheet app. Researchers also found internal records from 30 organizations, including six Fortune 500 companies, alongside a Tesla service center scorecard for 22 technicians, medical exam records for 3,784 construction workers in Peru, and a load board for an explosives manufacturing unit at a US industrial plant.
How Link Sharing and DNS Records Created the Vulnerability
The exposure stemmed largely from how Grok Build generates and publishes application addresses. Each app created on the platform receives a distinct hostname consisting of four random words under the grok.me domain. While random strings are difficult to guess directly, cybersecurity experts noted that every visit to an app generates a Domain Name System request that passive DNS databases record and index, allowing external researchers to discover active addresses. Claroc observed that in its paid account, Grok’s publish panel offered three visibility settings, with the open link option selected by default. SpaceX maintained that Grok applications remain private unless creators actively choose to share them through a multi-step publishing process accompanied by legal disclaimers, adding that employee accounts default toprivatevisibility.
App Removals and Prior Security Scrutiny
Claroc reported the vulnerability to SpaceX on November 8 and shared details on 22 additional employee apps on November 9, though all 24 remained accessible until Monday evening. Within hours of media inquiries, SpaceX began removing the employee links, which subsequently returned an error message, though broader removals of third-party public apps were not confirmed. Claroc recommended hosting apps under shared paths rather than separate subdomains, enforcing private defaults, and notifying affected organizations, having emailed three institutions directly before publishing its findings. The incident follows an earlier security issue in July 2026, when a researcher found Grok Build’s command-line tool uploading developers’ complete Git repositories and histories to cloud storage, prompting Elon Musk to pledge deletion of the uploaded data.
