35,578 Grok Build apps on grok.me opened with no sign-in. How to check and lock yours

What Claroc found

On November 10, 2026, the security company Claroc published a count of the apps people have made with Grok’s Build mode, which SpaceXSI calls Grok Build on web and mobile. You describe an app in the Grok chat, Grok writes it, and Publish gives it its own address, <name>.grok.me. Claroc loaded the first page of every address it could find, once, “from the public internet and signed in to nothing.”

What Claroc counted	Number
Names found under grok.me	43,601
Addresses it tried	43,551
Still online	37,571
Opened with no sign-in	35,578 (94.7%)
Answered with an error (HTTP 401)	1,993 (5.3%)
Open apps holding private data, by its estimate	650 to 800
Open apps built by SpaceXSI and X staff	24
Other organizations it could identify	30

“Most open apps were games, landing pages and calculators,” Claroc writes. “About 1 in 10 held sensitive material, internal business data or personal data.” Among those it read by hand: a hospital group’s roster of more than 3,500 employees, an intensive care briefing for one patient, a fire department’s shift board with names and badge numbers, and a contractor’s timesheet whose code held 18 accounts with their passwords in plain text. Of the 30 organizations, 26 have more than 1,000 employees and six are in the Fortune 500. Claroc names none of them. Ars Technica, which reported the research the same day, describes a Peruvian construction company’s dashboard of 3,784 worker medical exams and a Tesla service-center scorecard naming 22 technicians.

The 24 staff apps included a confidential onboarding plan for a new member of SpaceXSI’s enterprise sales team, a sales territory map of 594 accounts, and eight X advertising proposals, media plans and decks.

Why a grok.me link isn’t a secret

Grok proposes four random words for each app’s name, and Claroc says about half the names it saw were exactly that. The words don’t keep the link private, because they sit in the hostname. When anyone opens the app, their computer asks a DNS resolver where that name lives. “Passive DNS services collect those lookups from the resolvers they run or buy data from, and anyone with an account can search them by pattern,” Claroc writes. “So the first time the people a link was meant for use it, the name lands in a commercial index.”

Ars Technica’s Dan Goodin compares it with a Google Docs link, where the random part comes after the domain, in the path, which DNS never sees: “Had Grok followed Google’s approach, the links would have been invisible to passive DNS searchers.”

So a grok.me app is only as private as its access setting.

What Claroc and SpaceXSI say about that setting

Claroc built two test apps of its own, with made-up data. Building worked on Grok’s free plan, and publishing, in its account, needed a paid one. “In our account, the panel that opens offered Anyone with the link, Invited users and Only you, with Anyone with the link already selected.”

SpaceXSI describes it differently. A representative for Cursor, which SpaceXSI acquired, told Ars that Grok Build “apps are private by default and nothing goes public unless the creator chooses to share it,” and that ChatGPT, Lovable and Bolt offer shareable links too. According to Claroc, SpaceXSI told a reporter that publishing takes several steps, a legal disclaimer among them, and that its employees’ accounts start on Only you.

Claroc agrees that “nothing goes public before the builder clicks Publish.” Its point is the step after: “the people who published the 35,578 open apps went through every one of those steps.”

SpaceXSI’s own posts show how it presented publishing. Its July announcement of Build Mode said: “When it’s ready, publish it to a link anyone can open.” The publish sheet pictured in its August post shows Access set to “Anyone with the link,” and that post names the choices as “just you, anyone with the link, or the whole internet.”

A sign-in doesn’t settle it either. Claroc asked Grok for a customer list “for my company’s sales team of 4 people,” and Grok added “Continue with Google” and “Continue with X” buttons on its own. But “the code Grok wrote adds whoever signs in to the team before it checks whether they are on it, so the check always passes.” A Google account that had never been invited “signed in, saw every customer, changed one record and deleted another.” Claroc tested this only on its own app, and didn’t sign in to or change anyone else’s.

What SpaceXSI has done

Date	What happened
July 28, 2026	Build Mode opens to SuperGrok Heavy subscribers on the web, iOS and Android
August 19	Grok Build reaches every plan
November 8	Claroc reports the open apps to SpaceXSI, with four proposed fixes
November 9	Claroc reports the rest of the 24 staff apps
November 10	Claroc and Ars Technica publish, and SpaceXSI takes down the 24 staff apps

Ars writes that SpaceXSI “began removing the links within a few hours of Ars sending an email with questions for this article,” and that when the article went live, “almost all data remained available” apart from those 24 apps. Claroc says SpaceXSI “had not replied to our report” and took down its staff’s apps “but not the apps of other Grok users and organizations.” The Cursor representative didn’t answer Ars’s follow-up questions, including whether SpaceXSI planned to notify customers. As of November 11, SpaceXSI’s news page has nothing about it.

How to check your own apps

1. Find what you’ve published. Open each app you’ve built in Grok and look at its Publish sheet. The one SpaceXSI pictures shows whether the app is published, its grok.me address and its Access setting.
2. Open the address from outside. Use a private browser window, signed in to nothing. If the app loads, anyone who finds the name can open it. Claroc’s rule: “a stranger should get an error page.”
3. Set Access. “A Grok app holding anything internal should say Invited users or Only you,” Claroc writes. Ars’s advice is to invite people “unless they intend to make an app widely available.” In Claroc’s test, an app switched to Only you “answered 401 to a stranger on both the page and its data function.”
4. Unpublish what nobody uses. Claroc: “unpublishing takes a grok.me app offline at once.”
5. Test the sign-in with an outside account. “If an account from outside your company gets in, the app needs a list of who may use it.”
6. Read what the page ships. Claroc’s advice is to “search the scripts an app loads for names, emails and passwords.” Treat any password or key that sat in an open app as exposed, and replace it.

If you run a team, Claroc’s first step is to find out which builders people use: “Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio need no admin rollout and no company account.” With access to passive DNS, search it for those builders’ domains, and open what you find in a private window.

Other app builders

The addresses aren’t only Grok’s problem. Claroc lists where each product puts a shared thing:

What’s shared	Address	Can DNS see the secret part?
A Grok app	<name>.grok.me	Yes
A ChatGPT app	<app-name>.<username>.chatgpt.site	Yes
A Claude published artifact	claude.ai/public/artifacts/<id>	No, it’s in the path
A ChatGPT shared conversation	chatgpt.com/share/<id>	No, it’s in the path
A Gemini shared chat	gemini.google.com/share/<id>	No, it’s in the path

“Lovable, Replit, Base44, Google AI Studio and Meta’s Muse give each app its own hostname, and v0 and Bolt deploy to hostnames too,” Claroc writes. Its CTO, Asaf Aprozper, told Ars that Lovable, Bolt and Replit apps are exposed by “the same DNS records,” but that “Grok is where we found by far the most sensitive company data.”

What differs is where access starts. “When we clicked Share on an app ChatGPT built, access was set to Only me until we changed it,” so a ChatGPT address found in a DNS list “leads to an app that only its owner can open.” And a path isn’t private either: Claroc points to August 2025, when more than 370,000 shared Grok conversations turned up in Google search.

Grok Build in the terminal, and testing without a public link

The name covers two products. The open apps came from Build mode in the Grok app, the ones “people make by describing them to Grok and publish from the same chat window,” in Claroc’s words. Grok Build for the terminal is SpaceXSI’s coding agent, and Claroc’s report doesn’t describe it. Its changelog, which runs to version 1.0.77 of November 5, doesn’t mention grok.me.

Enjoy runs that terminal agent on your Grok or X subscription. A site an agent builds there runs on your computer at a localhost address, and Enjoy can show it on your phone, in a browser, or to people you’ve shared the project with through an encrypted connection to your computer, so trying it out doesn’t give it a public address. That isn’t hosting: the computer has to be on and awake with Enjoy open, and Enjoy doesn’t publish apps for the public. An app that strangers should reach still needs a host, and the right access setting there. Enjoy is a monthly subscription, with the first seven days free (pricing).

What hasn’t been said

• Whether SpaceXSI will change anything. Claroc sent four fixes: serve shared apps “on a hard-to-guess path under one host,” add an “everyone in my organization” option, “make Only you the default,” and warn at publish “when an app has a database and no sign-in.” It writes that “the default is a design choice SpaceXSI defended rather than a bug it said it would fix.”
• Whether SpaceXSI will tell the owners. It “holds the full list of app addresses and can reach every app’s owner, but its response did not say it would,” Claroc says. Claroc is notifying organizations itself, and had emailed three when it published.
• Whether anyone else found the apps first. Neither Claroc nor Ars says.
• Where the setting is documented. We couldn’t find a page on publishing apps or their access in SpaceXSI’s docs index. Its two announcements are what it has published.
• How many apps really hold private data. The 650 to 800 is an estimate: an AI model flagged pages, and Claroc checked it against a sample it read by hand. Claroc sells security for AI-built apps, and we found no independent recount.