Security firm Claroc finds Grok Build shared-app links enumerable via passive DNS, exposing data from thousands of apps including 24 SpaceXSI internal apps

Security firm Claroc reported that Grok Build shared-app links, which put random words to the left of grok.me, can be found through passive DNS records. It says it found 43,601 links, over 35,000 of them public, exposing business, medical and employee data. 24 of the apps belonged to SpaceXSI itself. After Ars Technica sent questions, SpaceXSI removed those 24 links (they now return "app not found"), but most other exposed apps were still reachable at publication.

Anyone who built and shared an app on Grok Build may have had its contents discoverable by third parties, so affected teams should assume exposure and review what those apps held. The flaw shows that secret links only work if the secret never leaves the page, and putting it in a hostname leaks it to DNS logs. Buyers of AI app builders have a concrete question to put to vendors. The reported mention of Fortune 500 and defence contractor data is serious, but the article names no organisations and the claim cannot be checked from what is given.

The figures and the Fortune 500 and defence contractor claims come from Claroc's own research as relayed by Ars Technica, with no independent verification or sample of the data shown. The comparison with Lovable, Bolt and Replit is a risk suggestion, not a demonstrated leak. Also, "public" links being exposed is partly the point of public links; the real harm is data that owners believed was private or obscure. The headline's "oodles" adds colour, not information.

1. 01Whether SpaceXSI changes the link design (for example moving the random token into the URL path) or removes or restricts the remaining exposed apps, and whether it issues a public statement or advisory.
2. 02Whether Claroc publishes its methodology or technical write-up, or any independent researcher reproduces the 43,601 count, and whether named organisations confirm their data was exposed.
3. 03Whether Lovable, Bolt, Replit or others are shown to have the same hostname-based exposure, or publicly confirm they do not; also any regulator or data-protection body response over the medical and employee data.