Grok Build Shared Your App With the Internet: 35,000 Live Links, 24 From SpaceXSI Itself

Grok Build turns a prompt into a working app in minutes, then publishes it at its own address such as cinder-crane-sand-frost.grok.me. The random words are meant to make the link impossible to guess. Claroc calls the result GhostShares: pages that open for people who were never given the link, and that those people can find on their own. Claroc listed 43,601 names under grok.me. Of 37,571 still online, 35,578 (94.7%) opened for anyone; only 1,993 answered with a sign-in error.

24 apps were built by SpaceXSI and X staff: an onboarding plan marked confidential for a new enterprise sales hire, a sales territory map of 594 accounts, eight X advertising proposals including one to a US federal agency, four live advertiser account boards and seven campaign reports. Claroc reported to SpaceXSI on Nov 8 through its security.txt address, got no reply, and escalated on X. SpaceXSI took its own 24 apps down but, per Claroc, not the apps of other users.

Beyond SpaceXSI, open apps held internal data from 30 identifiable organizations: 26 with more than 1,000 employees and six in the Fortune 500. Claroc began notifying them itself on Nov 10.

Other apps held 3,784 worker medical exams at a Peruvian construction firm, about 3,565 hospital staff names and IDs, an intensive care briefing for one patient, a fire department shift board with badge numbers, a staff timesheet whose code held 18 accounts with plain-text passwords, a roster of 108 people on a US Navy logistics contract, a Tesla service-center scorecard naming 22 technicians, a cruise galley checklist with crew names and IDs, loading procedures for an explosives building at a US defense plant, and about 4,000 vehicle transport orders with prices and margins.

In the paid account Claroc used, the publish panel had "Anyone with the link" already selected. SpaceXSI says apps stay private until the creator publishes, that publishing takes several clicks and a legal disclaimer, and that employee accounts default to Only you. Both are true at once: nothing goes public without Publish, and the access step that follows proposes everyone. The 35,578 open apps went through every one of those clicks.

Open may also mean writable. In two test apps of its own, Claroc found a database with no sign-in let any visitor add rows. A team app Grok built with "Continue with Google" added whoever signed in to the team before checking it, so an uninvited Google account could read, change and delete every record. Claroc tested this only on its own apps.

This is the root cause. Publishing set sharing to anyone with the link, and nothing at that moment told the builder that strangers could open the app and every record in it. As Claroc put it, had the sales team bought a tool for this, it would have sat behind company sign-in.

The Civilizations fix: Optimus Labs · Civilizations recommends making the choice explicit when the user shares, and allowing public access only as an opt-in, after a second review of what the app contains.

A browser has to look up a hostname before it can open a page. Passive DNS services log every new name they see, and anyone can search those logs. Grok puts the secret words at the front of the address (secret-words.grok.me), so every shared app becomes a public log entry.

Claude published artifacts, ChatGPT shared conversations and Gemini shares put the secret after the slash (claude.ai/public/artifacts/secret). That part never reaches the lookup logs.

DNS is only the first place these names show up. Once a link is posted, pasted into a chat or dropped into a shared document, search engines and AI crawlers can find it, store what the app shows and repeat it in answers. Taking the app down later does not remove copies already held in search caches, web archives or AI retrieval and training data. Claroc did not report this for Grok Build apps; we flag it as a risk because shared Grok, ChatGPT and Claude chats have all turned up in search before.

The Civilizations fix: give viewers an easy way to sign in instead of relying on a secret link, such as a one-time code or a short-lived guest login, and check that the person who signed in is on the invite list. Signing in proves who someone is, not that they belong. Keep secrets out of hostnames entirely.

Grok proposes four random words; Claroc saw about half the names kept them, and the rest were renamed by users. Ars Technica puts three truly random dice words at about 38 bits of entropy. That holds only if the words stay random and the word list is large. Do not trust the label "secret link" without testing it.

The Civilizations fix: use long random tokens, expire links, rate-limit lookups and watch for enumeration. Strengthen the design and the infrastructure, not just the token.

Find who in your company uses AI app builders. Treat every app they publish as an asset with an owner, not a side project.

In Grok Build, set every share link to invited users or only you, unless the app is meant to be public.

Search passive DNS for your teams' app subdomains on grok.me and other builder domains. Open each one signed out to see what a stranger sees.

Test sign-in from outside. If a personal Google account that was never invited gets into a team app, the app checks who you are but not whether you belong.

Read the script files each app loads for names, emails, keys and passwords, and unpublish any app nobody owns.

Search Google, Bing and the AI assistants your teams use for your apps' grok.me names, and request removal of anything cached or indexed. Unpublishing the app does not remove copies already made.

Rotate any key, token or password that sat inside an exposed app, and tell the people whose records it held.

Stay skeptical about the secret words. On the tools you use, test how easily the words could be guessed: how many words, how large the word list, and whether users can rename them.

Check your other builders too. Claroc says Base44 (Wix), v0 (Vercel), Bolt, Replit, Google AI Studio and ChatGPT also give apps their own hostnames. Also check Retool, Bubble, Zite, Webflow, Builder.io and Gumloop: how each shares and publishes, what the default is, and whether the secret sits in the hostname.

Tell your teams that one click on the link icon under a Grok chat reply creates a share link anyone can open. Copy the text instead, unless the conversation is meant to be public.

If your teams also run Grok Build on their laptops, run grokpatrol to see which repositories it collected and uploaded.

Grok is a gift that keeps on giving. In Aug 2025, more than 370,000 shared Grok conversations turned up in Google search. In July 2026 we showed the Grok Build CLI shipping whole repositories to xAI, and built grokpatrol so teams could check what left their laptops. This time the leak comes from the web builder.

FYSA: Grok chat still shares first and warns after. On Nov 11, 2026, we clicked the link icon under a reply on grok.com. Grok copied a share link to the clipboard at once, with no dialog and no choice of who can open it. The only notice came after the link existed, a toast that read "Shared links can be viewed by anyone with the link." and faded after a few seconds. A warning shown after the fact is not a security gate: it stops nothing and asks nothing. That is Issue 1 again, in the same chat product whose shared conversations turned up in Google search in 2025.

The pattern predates Grok Build. In May 2026, RedAccess told Axios it had found 380,000 publicly accessible apps built with Lovable, Base44, Replit and Netlify, about 5,000 of them holding sensitive corporate data: clinical trial details, a bank's internal financials, patient conversations. Privacy settings defaulted to public unless the user changed them, and many of the apps were indexed by Google. Grok Build repeated the same mistakes six months later.

The pattern is wider than Grok. In GhostShares Part 1, Claroc found more than 6,800 Meta Muse share hostnames in passive DNS, each named after the conversation's title; Meta suspended the feature on Oct 20, 2026 after Ars Technica asked. (We covered a separate Muse flaw earlier.) ChatGPT shared chats were findable on Google in 2025, and Claude shared chats and artifacts turned up in search in July 2026. Those links keep the secret out of DNS, but search indexing exposed them another way.

Claroc says Replit, Base44 (Wix), Google AI Studio and ChatGPT also give each published app its own hostname, and v0 (Vercel) and Bolt deploy to hostnames too, so the same DNS data can list them. The default decides what a listed name exposes: ChatGPT apps start as Only me and carry the username in the address. Grok held by far the most sensitive company data.