Grok Build share links exposed apps, including SpaceXSI data
Original title: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
A passive DNS search found 43,601 grok.me links, and more than 35,000 opened stored app data.
Researcher Aprozper said Grok Build defaults share links to “Anyone with the link,” so a grok.me URL opened the app and its stored data. Of 43,601 links, more than 35,000 were public, including material belonging to SpaceXSI. A Cursor representative said apps stay private unless the creator shares them; Aprozper’s tests found users had to change that default. Cursor did not say whether the exposure was intentional or whether affected users will be notified.
Unconfirmed: Cursor says apps are private by default; the researcher’s tests say public sharing is the default.
- Users can change links to “invited users” or “only you.”
- Lovable, Bolt, and Replit also publish DNS-visible app addresses.
- Claude, ChatGPT, and Gemini keep link randomness in the URL path.
- SpaceXSI data was removed after Ars asked about it.
Impact: Public access to stored app and company data
| Product | Affected |
|---|---|
| Grok Build | — |
- 1.Set Grok Build share links to invited users unless the app should be public.
- Products
- Grok Build
- Victims
- SpaceXSI
- Organizations
- Cursor
- AI models
- Grok
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | grok.me | r said a passive DNS search returned 43,601 links ending in grok.me. Of them, more than 35,000, or nearly 95 percent, were publ |
From the original article
1 min read at arstechnica.com
Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.