Security firm Claroc reported on 10 November 2026 that apps built with Grok Build, the coding agent from xAI (now part of the merged SpaceX and xAI company that Ars Technica calls SpaceXSI), could be found and opened by anyone through their public share links, exposing confidential data from thousands of apps. For research groups that use cloud coding agents on lab, clinical or participant data, the episode is a concrete reminder that a shared preview link is a disclosure channel.
What was reported
According to IBTimes UK, citing Claroc’s report and the Ars Technica coverage, more than 35,000 Grok Build apps were reachable without signing in. The data-science news site Let’s Data Science and RuntimeWire carry the same headline figure; RuntimeWire gives it as 35,578 published apps opened without a sign-in.
The reports describe the examples Claroc cited:
- An occupational-health dashboard at a Peruvian construction company holding 3,784 worker medical-exam records.
- A staff list of about 3,565 employees at a healthcare company.
- A roster of 108 people tied to a ship engineering contractor on a US Navy logistics contract.
- A Tesla service-centre scorecard naming 22 technicians with bonus status.
- 24 apps linked to SpaceXSI and X employees, including a sales onboarding plan, a territory map of 594 accounts, internal system addresses and advertising proposals.
How the apps were found
Per IBTimes UK’s summary of the Ars Technica report, shared apps use URLs with random words in the hostname, ahead of the grok.me domain. Passive DNS databases record such hostnames, which made the apps discoverable, whereas some other platforms place their random identifiers in the URL path, which DNS does not capture. Claroc co-founder Asaf Aprozper said “Anyone with the link” was preselected as the sharing setting in his tests.
Company response and timeline
IBTimes UK reports that Claroc notified SpaceXSI on 8 November and had no direct response by publication. After Claroc and Ars sought comment, the 24 SpaceXSI-linked apps were taken down and their links returned “App not found.” Let’s Data Science reports that at publication most other exposed data remained reachable, and that Claroc says it is notifying affected organisations. Reports differ on how the vendor’s position on default privacy settings was attributed, so this page does not restate it.
What it means for researchers and research offices
The following is editorial interpretation, not a finding of the reports.
- Treat share links as publication. A link that opens without authentication can be enumerated by third parties. Prototype dashboards built with a coding agent should not contain participant, patient, personnel or unpublished data.
- Check defaults. The report that “Anyone with the link” was preselected illustrates why sharing defaults belong in tool reviews.
- Bring coding agents into data-handling policy. Research offices, ethics committees and security teams can ask whether a given tool is approved for data covered by consent terms, data-use agreements or funder rules. For the wider picture of fast-moving AI tools and policy, see The Frontier LLM Landscape in August 2026.
- Know the incident-response path. If a project did use such a tool with sensitive data, the usual steps are to take shared links down, assess what was exposed and follow the institution’s breach-notification process.
What is not established
The reports give different framings of how many exposed apps held private data. Figures above are as reported by the named outlets and may change as the story develops.
