Grok Build leaks 35,000 private apps via DNS enumeration

Grok Build, the AI coding agent from SpaceXSI, is leaking confidential data from thousands of users, including proprietary business information from the company itself, according to research from security firm Claroc. The vulnerability stems from how the platform generates shareable links, allowing attackers to enumerate live projects and access their stored data without authorization. Claroc identified over 35,000 public apps, with 24 belonging to SpaceXSI, exposing sensitive internal documents such as sales plans and employee data.

The DNS Enumeration Flaw

The core issue lies in the placement of randomizing elements within Grok Build's URLs. Instead of placing the random string in the path (as Google Docs does), SpaceXSI places it in the subdomain to the left of the domain. This structure makes the links visible to passive DNS services, which monitor central DNS lookup servers. When a new subdomain is requested, the transaction is captured in publicly searchable databases. Claroc’s co-founder and CTO, Asaf Aprozper, stated that a passive DNS search returned 43,601 links ending in grok.me, with nearly 95% being public. "We were shocked," Claroc said. "The company that makes Grok had its own internal material open to anyone holding the link."

Exposed Data and Internal Failures

The exposed data includes internal business plans, ad proposals, medical exam results, and employee names and ID numbers. Among the 24 SpaceXSI apps found were an onboarding plan for an enterprise sales team, a sales territory map of 594 accounts, and internal system addresses. Claroc notified SpaceXSI on Sunday, but when no response was received, they tagged Elon Musk and Grok Manager Matt Palmer on X. SpaceXSI began removing the links within hours of Ars Technica sending an email for comment. A Cursor representative, noting that SpaceXSI recently acquired the AI coding service, claimed Grok Build apps are "private by default," but Aprozper’s tests contradicted this, showing users must manually change the setting from "Anyone with the link" to "invited users" or "only you."

Industry Context and Competitor Practices

This incident highlights a broader risk in AI coding platforms that use subdomain-based sharing. Aprozper noted that Lovable, Bolt, and Replit also expose DNS records, though Grok had the most sensitive data. In contrast, platforms like Claude, ChatGPT, and Gemini place the random string in the path, making them invisible to passive DNS searches. Meta’s Muse agent recently suspended a link-sharing feature after a similar leak, underscoring the growing scrutiny of security in AI-generated applications.

What It Means for Developers

Developers using Grok Build or similar platforms should immediately review their sharing settings. If you have shared links, change them to "invited users" or "only you" unless public access is intended. For teams, this incident underscores the need for strict access controls and regular audits of AI-generated applications. Organizations should also monitor passive DNS logs for unexpected subdomains and consider using platforms with path-based sharing to mitigate this risk.

What to Watch

• Whether SpaceXSI will notify other affected customers beyond the 24 internal apps.
• If Claroc’s findings lead to regulatory scrutiny of AI coding platforms.
• Whether other platforms like Lovable or Bolt will update their sharing mechanisms to avoid DNS exposure.
• The long-term impact on trust in AI-generated applications for sensitive data.