Grok's app builder left 35,000 apps open, including SpaceXSI's own
35,578 out of 37,571 live apps opened for anyone, no sign-in. That is what security firm Claroc counted among apps people built by describing them to Grok and publishing from the chat window. 24 of the open apps were built by SpaceXSI and X staff: a confidential onboarding plan for a new enterprise sales hire, a territory map of 594 strategic accounts, eight X advertising proposals including one to a U.S. federal agency marked confidential, and live advertiser spend boards. Claroc says it also found internal data from 30 other organizations it could identify, six of them in the Fortune 500. Full write-up: https://blog.claroc.io/ghostshares-grok-build-apps/
Timing matters here. Claroc's post is dated Nov 10 and Ars Technica ran the story at 21:12 UTC that day, just before this edition's window. The new part is the company's reply. On Wednesday Grok posted that the Ars article was "incorrect", that it concerns the "app builder feature on grok.com, not Grok Build", and that users review sharing settings and a warning before publishing (via The Verge: https://www.theverge.com/tech/1031600/spacexsis-grok-build-reportedly-leaked-private-info-from-thousands-of-users-including-its-own-business). Claroc says SpaceXSI took down its own staff's 24 apps after the report, but not the ones other users and organizations left open.
The real story is the default. In the account Claroc used, hitting Publish proposed "Anyone with the link". ChatGPT, in Claroc's comparison, set a shared app to "Only me" until changed. "Anyone with the link" was a tolerable setting when a human made a doc and sent it to three people. It is a bad setting when the thing being shared is a working app an agent built in five minutes from your sales pipeline, and when links leak into places nobody planned for. Claroc also says a team app Grok built for them let any Google account read, edit and delete records through "Continue with Google"; it tested that only on its own app.
Claroc's sharpest line sums it up: had the sales team bought a tool for this, it would have sat behind company sign-in. Vibe-coded internal tools skip procurement, skip IT review and skip SSO, and the agent writing them happily inherits whatever default the platform hands it. Last week's Apiiro report was about secrets in Claude Code's allowlists; last month Claroc did the same exercise on Meta's Muse. Three vendors, one pattern. Arguing over whether it is called Grok Build or the app builder misses the point. The question for every agent platform is what it publishes by default, and the answer should be "only me".
← Back to all articles
Timing matters here. Claroc's post is dated Nov 10 and Ars Technica ran the story at 21:12 UTC that day, just before this edition's window. The new part is the company's reply. On Wednesday Grok posted that the Ars article was "incorrect", that it concerns the "app builder feature on grok.com, not Grok Build", and that users review sharing settings and a warning before publishing (via The Verge: https://www.theverge.com/tech/1031600/spacexsis-grok-build-reportedly-leaked-private-info-from-thousands-of-users-including-its-own-business). Claroc says SpaceXSI took down its own staff's 24 apps after the report, but not the ones other users and organizations left open.
The real story is the default. In the account Claroc used, hitting Publish proposed "Anyone with the link". ChatGPT, in Claroc's comparison, set a shared app to "Only me" until changed. "Anyone with the link" was a tolerable setting when a human made a doc and sent it to three people. It is a bad setting when the thing being shared is a working app an agent built in five minutes from your sales pipeline, and when links leak into places nobody planned for. Claroc also says a team app Grok built for them let any Google account read, edit and delete records through "Continue with Google"; it tested that only on its own app.
Claroc's sharpest line sums it up: had the sales team bought a tool for this, it would have sat behind company sign-in. Vibe-coded internal tools skip procurement, skip IT review and skip SSO, and the agent writing them happily inherits whatever default the platform hands it. Last week's Apiiro report was about secrets in Claude Code's allowlists; last month Claroc did the same exercise on Meta's Muse. Three vendors, one pattern. Arguing over whether it is called Grok Build or the app builder misses the point. The question for every agent platform is what it publishes by default, and the answer should be "only me".
Comments