Claroc reported on November 10, 2026 that passive DNS exposes more than 35,000 live Grok Build apps on grok.me subdomains — many without a login — including confidential SpaceXSI sales material, Tesla service scorecards, hospital rosters, and defense contractor staffing lists, according to Ars Technica's coverage of the firm's research. The Claroc Blog published the finding the same day under the title GhostShares 2: Grok Apps Exposed.
If you treat vibe-coded mini-apps as disposable demos, this incident is the counterexample: defaults, share URLs, and DNS visibility turned internal spreadsheets into world-readable web apps.
Update (November 11, 2026): Patient data, plaintext passwords, and SpaceXSI pipeline apps
The Decoder's November 11 summary of Claroc's follow-up stresses categories Ars had only sampled: patient rosters and health workflows, password fields stored in plaintext inside demo admin panels, and SpaceXSI's own sales-onboarding pipeline (territory maps and internal tool URLs). Claroc still attributes the root cause to "Anyone with the link" remaining the default visibility preset on new Grok Build shares.
The Decoder adds that SpaceXSI removed only its 24 employee-built apps after press questions while Claroc's wider corpus of 35,000-plus anonymously published apps reportedly stayed reachable. That split matters for incident response: vendor self-cleanup does not retire third-party leaks sitting on the same DNS-discovery surface.
For purple teams, treat health and credentials-in-forms as mandatory search terms when auditing *.grok.me exposure, not only sales PDFs. Pair this update with Grok Bot connector scope reviews if builders bridge Build prototypes to production OAuth.
Agents that act on your behalf need rules. See how explainx helps secure your agents →
TL;DR
| Question | Answer (Nov 10, 2026) |
|---|---|
| Who found it? | Claroc (same team behind Muse GhostShares) |
| Scale | 43,601 grok.me hostnames in passive DNS; ~35,578 opened apps without auth per Claroc/Ars |
| Root cause | Share links meant to be unguessable, but hostnames are indexed in DNS |
| Default ACL | Anyone with the link per Ars quoting Claroc tests |
| Notable victims | SpaceXSI (24 internal apps), plus Tesla, hospitals, cruise lines, defense vendors in samples |
| SpaceXSI response | 24 internal links removed after Ars questions; wider corpus largely still live at publication time |
What Grok Build shares actually do
Grok Build is SpaceXSI's vibe-coding surface: describe an app in natural language, iterate with the agent, then publish a working prototype on a *.grok.me URL for coworkers to try. Sharing is a feature, not a bug — product teams want a one-click preview without provisioning Kubernetes.
The security model assumes URL secrecy. Grok generates multi-word slugs such as cinder-crane-sand-frost.grok.me so casual guessing should fail.
Claroc's argument — documented on the Claroc Blog and relayed by Ars — is that secrecy fails when the slug is a public DNS record. Passive DNS providers log resolutions globally. A researcher who never received your link can still query historical hostnames and get a scrollable directory of live apps.
That is the same architectural mistake Claroc highlighted when Muse share links leaked prep notes for a frontier-lab CEO call in October 2026. Claroc calls the pattern GhostShares: pages that are public-by-link but discoverable-by-DNS.
Grok Build confidential data exposure through passive DNS on grok.me subdomains
What was inside the exposed apps
Ars worked from Claroc samples rather than dumping raw URLs — the right ethics line — but the categories are enough for security teams to panic responsibly.
SpaceXSI's own builds. Claroc counted 24 internal apps, including a confidential enterprise-sales onboarding plan, a 594-account territory map, internal endpoints for sales systems, and advertising proposals. Ars reports SpaceXSI pulled those links within hours of media questions while leaving most third-party exposures untouched.
Other organizations named by Ars, all via Claroc research:
- A Peruvian construction firm: 3,784 worker medical-exam records in an occupational-health dashboard.
- Tesla: service-center scorecard naming 22 technicians with productivity and bonus fields.
- A U.S. Navy logistics contractor: roster of 108 people on a support contract.
- A luxury cruise line: galley checklist with crew legal names and employee IDs.
- A healthcare group: ~3,565 hospital staff names and IDs.
- Retail and manufacturing samples: confidential BOMs, explosives-plant load boards, home-builder sales sheets with financing notes, and ~4,000 vehicle-transport orders with margins.
None of this requires exploiting Grok's model weights or stealing API keys. Clicking a hostname was enough.
Why passive DNS defeats random slugs
Most engineers intuit that long hostnames are secrets. Passive DNS breaks that intuition.
When any resolver anywhere looks up cinder-crane-sand-frost.grok.me, commercial passive-DNS vendors may retain the name. Attackers buy the feed, search for *.grok.me, and export tens of thousands of rows. Claroc's Muse research opened 6,800+ Muse shares the same way; Grok Build scaled an order of magnitude larger in Claroc's November run.
The Claroc Blog's Muse write-up also noted that robots.txt blocks crawlers but does not stop humans or security tools from resolving DNS. Grok Build inherits that limitation if apps stay on predictable parent domains.
For builders, the lesson matches PixelLeak: agents optimize for fast handoff to humans (screenshots on GitHub, share links on grok.me) and ignore data-classification policy unless the harness forbids it.
Defaults and options users rarely change
Ars quotes Claroc's Mathieu Aprozper saying that in tests over the prior week, Grok Build defaulted new projects to Anyone with the link. The product offers tighter modes — invited users and only you — but a 95% public rate in Claroc's corpus suggests most builders never touch the toggle.
That matches how Grok Build repository uploads already worried security reviewers months earlier: speed-first workflows publish before legal reviews.
If your organization adopted Grok Build for hack weeks, ask whether any employee can still publish customer CSVs with one prompt. This incident says the answer is probably yes.
What developers are saying
Claroc's Muse GhostShares thread drew comparisons to Google Drive link sprawl and S3 bucket listing on Hacker News in October. Early Ars OpenForum discussion on the Grok story (November 10, 2026) repeats two practical points:
- Vibe-coded apps are production databases once they ingest a real CSV export.
- Passive DNS is offensive OSINT, not a niche trick — red teams already bill for it.
We did not treat forum posts as verified victim counts; they are useful for harness requirements you can paste into policy docs today.
How to protect your org
Treat Grok Build (and every similar AI app builder) like shadow IT hosting:
- Inventory — Search passive-DNS feeds and browser history for
grok.mein your domain's egress logs. - Delete or lock — Remove prototypes; switch surviving apps to invited users or offline export.
- Classify data — Ban HR, PHI, customer PII, and unreleased financials in agent builders; use synthetic fixtures only.
- Secrets rotation — If an exposed app ever held API keys or passwords, rotate immediately; assume compromise.
- Monitoring — Add
grok.me,lovable.app, and other agent PaaS domains to the same watchlist you use for pastebin and anonymous file hosts.
For agent pipelines that cannot be unplugged, runtime guardrails help catch exfil-shaped actions before they publish. The explainx.ai team ships AgentBeam for teams that want policy checks on agent tool use — pair it with DNS discovery, not instead of it.
What people are asking
| Question | Practical answer |
|---|---|
| Is my app still up? | If anyone published on grok.me with default sharing, assume yes until you verify each URL or get admin takedown. Passive DNS keeps historical names even after you delete data. |
| Does making the app "private" fix DNS? | Partially. Tight ACLs stop casual viewers, but hostnames may remain in passive DNS until TTLs expire. Treat discovery risk separately from live content risk. |
| Is this a CVE? | No assigned CVE as of November 10. It is a deployment and defaults failure, similar in class to Muse GhostShares, not a buffer overflow. |
| Should we ban Grok Build? | Banning rarely scales. Block egress to builder domains, require security review before publish, and use synthetic data in prompts — same playbook as early Heroku hobby tiers. |
| Who is liable? | Ars notes SpaceXSI argued apps are private by default while Claroc measured 95% public links. Legal outcomes are unsettled; your compliance team still owns data you uploaded. |
Comparison: Muse GhostShares vs Grok Build
| Dimension | Muse (October 2026) | Grok Build (November 2026) |
|---|---|---|
| Discovery mechanism | Titles embedded in share hostnames | Dice-word subdomains on grok.me |
| Claroc scale cited | 6,800+ hostnames | 43,601 hostnames, 35,578 live apps |
| Org response | Meta suspended sharing after Ars | SpaceXSI removed 24 internal apps; wider corpus mostly live |
| Data classes | Personal finance, CEO reviews, hiring prep | HR rosters, medical exams, defense rosters, sales BOMs |
| Lesson | robots.txt ≠ access control | Random URLs ≠ secrecy when DNS is public |
Teams that patched Muse by blocking meta.ai shares should extend policy to every AI app PaaS with share-by-URL semantics — Lovable, Replit, Bolt, and internal Cursor deploy previews included.
Incident response checklist for security teams
- Threat intel — Subscribe to passive-DNS feeds; schedule weekly
*.grok.mequeries. - Employee outreach — Tell builders share links are not secret; demo data only.
- DLP — Flag exports toward
grok.mein corporate proxies where possible. - Legal hold — If medical or defense data appeared, involve counsel before mass URL probing (researchers had ethical sampling; your red team might not).
- Vendor questions — Ask SpaceXSI whether DNS-level discovery will be blocked, defaults will flip to private, or enterprise tenants get isolated domains.
How this fits the 2026 agent-security arc
November 10 was already crowded: Notion AI chat transcripts surfaced in the Fireworks breach, and eBay blocked third-party shopping agents. Grok Build adds the publish-to-random-URL failure mode — closer to Railway's environment-variable emergency in blast radius for non-technical staff.
SpaceXSI's partial takedown of its own 24 apps shows the issue is operational, not hypothetical. Until the platform changes defaults or DNS visibility, assume every Grok Build share is world enumerable.
Related reading
- Claude Cage VM sandbox for isolated Claude Code sessions
- Grok Build open-sourced: what the Apache 2.0 drop includes
- Grok Build repo uploads and secret hygiene
- Meta Muse GhostShares and passive DNS
- PixelLeak: agents posting screenshots to public GitHub
- What is an agent harness?
- MCP security guide for builders
- Notion-Fireworks transcript exposure
App-builder defaults, DNS vendor coverage, and victim response timelines are accurate as of November 10, 2026.