Does this concern you?
- Affected: companies whose people build apps in an AI chat and publish them, Grok Build above all. Lovable, Replit, v0, Bolt and Base44 also give each app its own hostname, so their apps are as findable (Claroc); their defaults were not reported. None needs a company account.
- Skip it if: no colleague publishes apps from AI builders. Claude artifacts and ChatGPT or Gemini shared chats keep the link's secret in the URL path, which DNS never sees, though search indexing can still expose it (Claroc).
What to do
- Ask colleagues which AI builders they use and what they published.
- If you have access to passive DNS data, search it for grok.me and the other builders' domains (Claroc's advice).
- Have the owner of every Grok app holding internal or personal data pick the Invited users or Only you setting, then check from a signed-out private window that a stranger gets an error page.
- If an app has "Continue with Google" sign-in, try an outside account: in Claroc's test app any Google account could read, edit and delete records. If one gets in, the app needs a list of who may use it.
- Search the script files an app loads for names, emails and passwords, and change any password found; Claroc found one exposing every employee's password.
- Unpublish apps nobody owns – Claroc says this takes a Grok app offline within seconds.
- An app storing data without sign-in may have been edited by visitors (shown on Claroc's own app): check its data.
What we know – and what we don't
- Each Grok app has its own hostname. Once anyone opens it, the name lands in passive DNS data, searchable by pattern for anyone with an account there (Claroc; Ars Technica via Mezha).
- Default: both sides agree nothing is public before Publish. Claroc says Publish then proposed "Anyone with the link" in its account; a spokesperson for Cursor, which SpaceXSI acquired, says the apps are private by default.
- SpaceXSI removed its own 24 open apps – after Claroc's report, says Claroc; within hours of its questions, says Ars Technica (via Mezha). Almost all other exposed data was still reachable when Ars Technica published.
- Not known: whether anyone besides Claroc found and used these apps.
Why it matters
In our view the weak point is the publish button: whoever runs a sales territory or shift roster can put a tool online in minutes, unseen by IT, and a link nobody was given can still be found.