Grok Build: 35,578 Applications Opened, 24 Internal Ones Withdrawn

Researchers have identified thousands of Grok Build applications accessible without authentication, some of which exposed sensitive data. Twenty-four internal projects related to the publisher have been removed, but the extent of the exposures and their overall remediation remains uncertain.

Partial Remediation and Uncertainties About Remaining Scope

After receiving a report and responding to inquiries, the publisher removed the 24 identified internal applications developed by members of SpaceXSI and X. Among these applications were a confidential business integration schema and a representation of 594 customer accounts. Researchers indicated that applications created by other users remained accessible at the time of their report's publication. It has not been confirmed whether the issue has been fully resolved or if any malicious exploitation occurred.

Easily Traceable Links and Options That Are Too Broad

Each published Grok Build application receives an address composed of random words before the grok.me domain, making its data accessible to anyone with the link. These subdomains can be cataloged through passive DNS databases, which retain resolution history, allowing researchers to identify thousands of addresses without having to guess them individually. On a tested paid account, the option "Anyone with the link" was pre-selected. However, SpaceXSI contests the idea of automatic publication and claims that the user must publish the application, with a private setting as the default for employee accounts.

Access Without Authentication and Identity Control Flaws

During a review, 35,578 applications out of 37,571, or 94.7%, were accessible without authentication. In a separate test, the "Continue with Google" button allowed any Google account to access an application, enabling the ability to view, modify, and delete data. This test does not apply to all Grok Build applications, but it shows that a login screen does not guarantee security if permissions are misconfigured.

Scale of Exposures and Concrete Examples

Researchers report that over 35,000 Grok Build applications could be accessed without authentication. They estimate that about 10% of these applications exposed internal or personal data, identifying between 650 and 800 cases presenting a high or critical risk. Among the mentioned cases are a medical record of a patient in intensive care, a list of over 3,500 employees of a hospital group, and a time management application displaying 18 accounts accompanied by plaintext passwords. However, some of the accessible applications were simple games or calculators.

Alert, Timeline, and Safeguards to Check

Claroc reported the issues to SpaceXSI on November 8 and 9, then published its GhostShares 2 investigation on November 10, 2026. Grok Build allows users to create applications without coding, using natural language descriptions. Researchers emphasize that the speed of deployment exceeds security verification capabilities, which constitutes a structural weakness. The time savings are real, but identity, access rights, and database protection are not automatically ensured. Users are advised to check publication settings, test access with an external account, and open applications in a disconnected browser. Before hosting sensitive data, one should consider who can actually access it. Researchers also noted confidential information related to a company owned by Elon Musk and the risk that third parties could find links shared among colleagues.