KEY POINTS
- Claroc found more than 35,000 publicly reachable Grok Build apps through passive DNS searches.
- Exposed material included 24 internal SpaceXSI apps, which were taken down after Ars Technica asked the company about them.
- Grok Build links default to 'Anyone with the link', according to Claroc's tests.
Grok Build, the AI coding agent from SpaceXSI, is exposing data from thousands of apps built by its users, including internal material from SpaceXSI itself, according to research by the security firm Claroc. Ars Technica reported the findings on Tuesday.
The problem lies in the links users create to share their apps. Each link starts with randomly generated words and ends in grok.me, so that only people who know the exact address can open the app. Claroc says the random part sits to the left of the domain name, which means it shows up in passive DNS databases. These publicly searchable services record lookups of previously unseen addresses, so anyone can list the links. Google, by contrast, puts the random string in the path after the domain, where DNS services cannot see it.
