# Grok Build Shared Your App With the Internet: 35,000 Live Links, 24 From SpaceXSI Itself
> Research by Claroc. Vibe-coded business apps went public with no clear warning and no sign-in. The share link's secret words sat in the hostname, so public DNS data listed 43,601 of them. Grok keeps giving.
- **Publisher:** Optimus Labs · Civilizations
- **Published:** 2026-11-11
- **Severity:** HIGH · DATA EXPOSURE
- **Types:** Posture, Agent, Credential
- **Vendors / products affected:** Grok Build, xAI
- **Blast radius:** Anyone who built and shared an app with Grok Build, and anyone whose data those apps hold: employees, patients, customers and sales prospects. Passive DNS shows only links someone resolved, so the 43,601 count is a floor.
- **Canonical URL:** https://optimuslabs.io/research/briefings/grok-build-share-link-dns-exposure
## TL;DR

As of Nov 11, 2026. Claroc listed 43,601 Grok Build app addresses. Of 37,571 still online, 35,578 (94.7%) opened with no sign-in, including 24 apps built by SpaceXSI and X staff. Three failures stacked: public by default with no clear warning, secret words in the hostname, and too little entropy. Treat agent-built apps as assets in your inventory.

## Summary

Grok Build is the vibe-coding agent from SpaceXSI. SpaceX and xAI merged to form SpaceXAI, which is now SpaceXSI. [Claroc](https://blog.claroc.io/ghostshares-grok-build-apps/) listed 43,601 Grok Build app addresses under grok.me, as [Ars Technica reported](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/). Of the 37,571 still online, 35,578 (94.7%) opened the app and its data with no sign-in. 24 were built by SpaceXSI and X staff, including a confidential sales onboarding plan and a 594-account territory map. Claroc estimates 650 to 800 apps held private data. The core failure is not DNS. Business apps went public without clearly telling the person who built them, and without safeguards that are secure by default. The DNS design made that exposure easy to find.

## What Claroc found

**The company that makes Grok had its own internal material open to anyone holding the link.**

- Grok Build turns a prompt into a working app in minutes, then publishes it at its own address such as cinder-crane-sand-frost.grok.me. The random words are meant to make the link impossible to guess. Claroc calls the result [GhostShares](https://blog.claroc.io/ghostshares-grok-build-apps/): pages that open for people who were never given the link, and that those people can find on their own. Claroc listed 43,601 names under grok.me. Of 37,571 still online, 35,578 (94.7%) opened for anyone; only 1,993 answered with a sign-in error.
- 24 apps were built by SpaceXSI and X staff: an onboarding plan marked confidential for a new enterprise sales hire, a sales territory map of 594 accounts, eight X advertising proposals including one to a US federal agency, four live advertiser account boards and seven campaign reports. Claroc reported to SpaceXSI on Nov 8 through its security.txt address, got no reply, and escalated on X. SpaceXSI took its own 24 apps down but, per Claroc, not the apps of other users.
- Beyond SpaceXSI, open apps held internal data from 30 identifiable organizations: 26 with more than 1,000 employees and six in the Fortune 500. Claroc began notifying them itself on Nov 10.
- Other apps held 3,784 worker medical exams at a Peruvian construction firm, about 3,565 hospital staff names and IDs, an intensive care briefing for one patient, a fire department shift board with badge numbers, a staff timesheet whose code held 18 accounts with plain-text passwords, a roster of 108 people on a US Navy logistics contract, a Tesla service-center scorecard naming 22 technicians, a cruise galley checklist with crew names and IDs, loading procedures for an explosives building at a US defense plant, and about 4,000 vehicle transport orders with prices and margins.
- In the paid account Claroc used, the publish panel had "Anyone with the link" already selected. SpaceXSI says apps stay private until the creator publishes, that publishing takes several clicks and a legal disclaimer, and that employee accounts default to Only you. Both are true at once: nothing goes public without Publish, and the access step that follows proposes everyone. The 35,578 open apps went through every one of those clicks.
- Open may also mean writable. In two test apps of its own, Claroc found a database with no sign-in let any visitor add rows. A team app Grok built with "Continue with Google" added whoever signed in to the team before checking it, so an uninvited Google account could read, change and delete every record. Claroc tested this only on its own apps.

## Issue 1: insecure by default, and the user is never told

**A sales tool that would have gone through procurement went live with no review and no sign-in.**

- This is the root cause. Publishing set sharing to anyone with the link, and nothing at that moment told the builder that strangers could open the app and every record in it. As Claroc put it, had the sales team bought a tool for this, it would have sat behind company sign-in.
- The Civilizations fix: Optimus Labs · Civilizations recommends making the choice explicit when the user shares, and allowing public access only as an opt-in, after a second review of what the app contains.

## Issue 2: the secret words sit in the hostname, and DNS logs record them

- A browser has to look up a hostname before it can open a page. Passive DNS services log every new name they see, and anyone can search those logs. Grok puts the secret words at the front of the address (secret-words.grok.me), so every shared app becomes a public log entry.
- Claude published artifacts, ChatGPT shared conversations and Gemini shares put the secret after the slash (claude.ai/public/artifacts/secret). That part never reaches the lookup logs.
- DNS is only the first place these names show up. Once a link is posted, pasted into a chat or dropped into a shared document, search engines and AI crawlers can find it, store what the app shows and repeat it in answers. Taking the app down later does not remove copies already held in search caches, web archives or AI retrieval and training data. Claroc did not report this for Grok Build apps; we flag it as a risk because shared Grok, ChatGPT and Claude chats have all turned up in search before.
- The Civilizations fix: give viewers an easy way to sign in instead of relying on a secret link, such as a one-time code or a short-lived guest login, and check that the person who signed in is on the invite list. Signing in proves who someone is, not that they belong. Keep secrets out of hostnames entirely.

## Issue 3: not enough entropy

- Grok proposes four random words; Claroc saw about half the names kept them, and the rest were renamed by users. Ars Technica puts three truly random dice words at about 38 bits of entropy. That holds only if the words stay random and the word list is large. Do not trust the label "secret link" without testing it.
- The Civilizations fix: use long random tokens, expire links, rate-limit lookups and watch for enumeration. Strengthen the design and the infrastructure, not just the token.

## What to do now

- Find who in your company uses AI app builders. Treat every app they publish as an asset with an owner, not a side project.
- In Grok Build, set every share link to invited users or only you, unless the app is meant to be public.
- Search passive DNS for your teams' app subdomains on grok.me and other builder domains. Open each one signed out to see what a stranger sees.
- Test sign-in from outside. If a personal Google account that was never invited gets into a team app, the app checks who you are but not whether you belong.
- Read the script files each app loads for names, emails, keys and passwords, and unpublish any app nobody owns.
- Search Google, Bing and the AI assistants your teams use for your apps' grok.me names, and request removal of anything cached or indexed. Unpublishing the app does not remove copies already made.
- Rotate any key, token or password that sat inside an exposed app, and tell the people whose records it held.
- Stay skeptical about the secret words. On the tools you use, test how easily the words could be guessed: how many words, how large the word list, and whether users can rename them.
- Check your other builders too. Claroc says Base44 (Wix), v0 (Vercel), Bolt, Replit, Google AI Studio and ChatGPT also give apps their own hostnames. Also check Retool, Bubble, Zite, Webflow, Builder.io and Gumloop: how each shares and publishes, what the default is, and whether the secret sits in the hostname.
- Tell your teams that one click on the link icon under a Grok chat reply creates a share link anyone can open. Copy the text instead, unless the conversation is meant to be public.
- If your teams also run Grok Build on their laptops, run [grokpatrol](/grokpatrol/) to see which repositories it collected and uploaded.

## Share links are a poorly designed feature, again

- Grok is a gift that keeps on giving. In Aug 2025, [more than 370,000 shared Grok conversations](https://fortune.com/2025/08/22/xai-grok-chats-public-on-google-search-elon-musk/) turned up in Google search. In July 2026 we showed the [Grok Build CLI shipping whole repositories to xAI](/research/briefings/grok-build-repo-exfiltration), and built [grokpatrol](/grokpatrol/) so teams could check what left their laptops. This time the leak comes from the web builder.
- **FYSA: Grok chat still shares first and warns after.** On Nov 11, 2026, we clicked the link icon under a reply on grok.com. Grok copied a share link to the clipboard at once, with no dialog and no choice of who can open it. The only notice came after the link existed, a toast that read "Shared links can be viewed by anyone with the link." and faded after a few seconds. A warning shown after the fact is not a security gate: it stops nothing and asks nothing. That is Issue 1 again, in the same chat product whose shared conversations turned up in Google search in 2025.
- The pattern predates Grok Build. In May 2026, RedAccess told [Axios](https://www.axios.com/2026/05/07/loveable-replit-vibe-coding-privacy) it had found 380,000 publicly accessible apps built with Lovable, Base44, Replit and Netlify, about 5,000 of them holding sensitive corporate data: clinical trial details, a bank's internal financials, patient conversations. Privacy settings defaulted to public unless the user changed them, and many of the apps were indexed by Google. Grok Build repeated the same mistakes six months later.
- The pattern is wider than Grok. In [GhostShares Part 1](https://blog.claroc.io/ghostshares-muse-passive-dns/), Claroc found more than 6,800 Meta Muse share hostnames in passive DNS, each named after the conversation's title; Meta suspended the feature on Oct 20, 2026 after Ars Technica asked. (We covered a [separate Muse flaw](/research/briefings/meta-muse-dictation-endpoint-hijack) earlier.) [ChatGPT shared chats](https://www.malwarebytes.com/blog/news/2025/08/openai-kills-short-lived-experiment-where-chatgpt-chats-could-be-found-on-google) were findable on Google in 2025, and [Claude shared chats and artifacts](https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/) turned up in search in July 2026. Those links keep the secret out of DNS, but search indexing exposed them another way.
- Claroc says Replit, Base44 (Wix), Google AI Studio and ChatGPT also give each published app its own hostname, and v0 (Vercel) and Bolt deploy to hostnames too, so the same DNS data can list them. The default decides what a listed name exposes: ChatGPT apps start as Only me and carry the username in the address. Grok held by far the most sensitive company data.

## What to do

- Find who in your company uses AI app builders. Treat every app they publish as an asset with an owner, not a side project.
- In Grok Build, set every share link to invited users or only you, unless the app is meant to be public.
- Search passive DNS for your teams' app subdomains on grok.me and other builder domains. Open each one signed out to see what a stranger sees.
- Test sign-in from outside. If a personal Google account that was never invited gets into a team app, the app checks who you are but not whether you belong.
- Read the script files each app loads for names, emails, keys and passwords, and unpublish any app nobody owns.
- Search Google, Bing and the AI assistants your teams use for your apps' grok.me names, and request removal of anything cached or indexed. Unpublishing the app does not remove copies already made.
- Rotate any key, token or password that sat inside an exposed app, and tell the people whose records it held.
- Stay skeptical about the secret words. On the tools you use, test how easily the words could be guessed: how many words, how large the word list, and whether users can rename them.
- Check your other builders too. Claroc says Base44 (Wix), v0 (Vercel), Bolt, Replit, Google AI Studio and ChatGPT also give apps their own hostnames. Also check Retool, Bubble, Zite, Webflow, Builder.io and Gumloop: how each shares and publishes, what the default is, and whether the secret sits in the hostname.
- Tell your teams that one click on the link icon under a Grok chat reply creates a share link anyone can open. Copy the text instead, unless the conversation is meant to be public.
- If your teams also run Grok Build on their laptops, run [grokpatrol](/grokpatrol/) to see which repositories it collected and uploaded.

## Timeline

- 2026-11-08 — Claroc reports to SpaceXSI: Via security.txt, with counts, two test apps and four fixes.
- 2026-11-09 — 22 more staff apps reported
- 2026-11-10 — SpaceXSI answers a reporter, removes its 24 apps: Other users' open apps stay up, per Claroc.
- 2026-11-10 — Claroc and Ars Technica publish: Claroc begins notifying affected organizations.
- 2026-11-11 — Optimus Labs: Grok chat still makes one-click share links: The anyone-with-the-link notice appears after the copy and fades in seconds; it is not a gate.

## How Optimus Labs helps

Agent-built apps are shadow software. Optimus Labs discovers the agents and app builders your people use, maps each to an owner, and flags risky posture such as public sharing, so a sales tool built in an afternoon gets the same review as one bought through procurement.

## Questions and answers

**What did Grok Build leak?**

Apps built with Grok Build and published by link were open to anyone. Claroc listed 43,601 grok.me addresses; 35,578 of 37,571 online apps opened with no sign-in, including 24 built by SpaceXSI and X staff, plus medical records, staff rosters, customer orders and one app with plain-text passwords.

**What are GhostShares?**

GhostShares is Claroc's name for shared AI pages and apps that open for people who were never given the link and can be found through DNS data. Part 1 covered Meta Muse shares; Part 2 covered Grok Build apps.

**What is SpaceXSI?**

SpaceXSI is the company that makes Grok and Grok Build. SpaceX and xAI merged to form SpaceXAI, which is now named SpaceXSI.

**Why could anyone find Grok Build share links?**

The random words that make a link secret sit in the hostname, such as words.grok.me. Opening the link requires a DNS lookup, and passive DNS services log those names in searchable databases.

**Can search engines or AI tools index public Grok Build apps?**

They can. An app that opens with no sign-in can be found by search engines and AI crawlers once its link is posted anywhere, and they can keep copies after the app is taken down. Claroc did not report indexing of Grok Build apps; we assess it as a risk based on earlier Grok, ChatGPT and Claude share-link incidents. Search for your apps' names and request removal of cached copies.

**How do I protect a Grok Build app?**

Change sharing from anyone with the link to invited users or only you, open your links while signed out to see what a stranger sees, and rotate any secret that was inside an exposed app.

**Does Grok chat warn before it creates a share link?**

Not in our Nov 11, 2026 test. One click on the link icon under a Grok reply copied a share link at once. The notice that anyone with the link can view it appeared only after the link was copied and faded after a few seconds. It is a notice, not a security gate: nothing asks you to confirm or choose who can view.

**Do other AI app builders have the same risk?**

Claroc says Replit, Base44, Google AI Studio and ChatGPT give each published app its own hostname, and v0 and Bolt deploy to hostnames, so DNS data can list them too. What a listed name exposes depends on the default access setting. Also check Retool, Bubble, Zite, Webflow, Builder.io and Gumloop.

## Sources

- [Ars Technica: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI (Nov 10, 2026)](https://arstechnica.com/security/2026/11/grok-build-coding-agent-leaks-oodles-of-confidential-info-some-belonging-to-spacexsi/)
- [Claroc Research: GhostShares, Part 2, AI-built apps are exposing sensitive internal data again (Nov 10, 2026)](https://blog.claroc.io/ghostshares-grok-build-apps/)
- [Claroc Research: GhostShares, Part 1, Meta Muse shares listed by passive DNS (Oct 2026)](https://blog.claroc.io/ghostshares-muse-passive-dns/)
- [Fortune: 370,000 shared Grok chats public on Google search (Aug 22, 2025)](https://fortune.com/2025/08/22/xai-grok-chats-public-on-google-search-elon-musk/)
- [Optimus Labs: Grok Build CLI shipped entire repos to xAI (Jul 2026)](https://optimuslabs.io/research/briefings/grok-build-repo-exfiltration)
- [Optimus Labs: grokpatrol, offline scanner for Grok Build](https://optimuslabs.io/grokpatrol/)
- [TechCrunch: Claude shared chats and Artifacts may have ended up on Google (Jul 27, 2026)](https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/)
- [Malwarebytes: OpenAI removes discoverable ChatGPT shared chats (Aug 1, 2025)](https://www.malwarebytes.com/blog/news/2025/08/openai-kills-short-lived-experiment-where-chatgpt-chats-could-be-found-on-google)
- [Axios: AI vibe-coding apps leak sensitive data (May 7, 2026)](https://www.axios.com/2026/05/07/loveable-replit-vibe-coding-privacy)

## Related use case

- [Detect undesired activity](https://optimuslabs.io/use-cases/detect-undesired-activity)

## Related tool

- [grokpatrol](/grokpatrol/): Offline, read-only scanner for the Grok Build CLI. It reports which repositories were collected, staged and sent, and prints paths and git object IDs only.

---

Published by Optimus Labs · Civilizations, the threat research team at Optimus Labs. Optimus Labs secures the enterprise agentic AI attack surface: discovery and governance of every AI agent, MCP server, and SKILL, posture management against the OWASP Top 10 for Agentic Applications, and runtime behaviour anomaly detection. More briefings: https://optimuslabs.io/research/briefings