Claroc Research: Grok Build Apps Were Accessible Without Sign-In

Grok Build apps may have been widely accessible without signing in through publicly discoverable addresses on the grok.me domain. This follows research by Claroc published on November 10, 2026. Researchers claim they found 24 tools created by SpaceXSI and X employees among the exposed apps. However, this is not confirmed evidence of a breach of either company’s systems or confirmed widespread data misuse.

Claroc tested 43,551 addresses under the grok.me domain. According to the research, 37,571 were active, and 35,578 of them—94.7 percent of active addresses—opened without authentication. These figures come from Claroc’s methodology and have not been independently reproduced.

Grok Build apps and access settings

Grok Build is a tool for rapidly creating apps. An official SpaceXSI resource states that a published app receives its own address on the grok.me domain. When publishing, the author chooses between “Only you,” “Anyone with the link,” or public access.

The “Anyone with the link” option is particularly important here. A URL that appears random is not, by itself, reliable protection if its name can be discovered, for example through DNS. Access without signing in also means that app availability is determined not only by whether a user has an account, but also by the authorization rules set when the app is shared.

Claroc claims that when publishing from its paid account, the default setting was “Anyone with the link.” According to the researchers, SpaceXSI said that apps remain private until their author shares them, and that “Only you” should be the default for employee accounts. This discrepancy for regular accounts has not been independently resolved.

SpaceXSI and X internal tools were taken down after being reported

Researchers said that 24 publicly accessible apps were created by SpaceXSI and X employees. The apps were reportedly taken down after being reported. Ars Technica also reported secondhand on the removal of links to internal apps following questions from its editorial team.

Claroc also emphasizes the limits of its testing. It demonstrated the exposure using two of its own test apps and does not claim to have written data to or signed in to third-party apps. The research is therefore not evidence that SpaceXSI or X infrastructure was compromised.

The company estimates that 650 to 800 exposed apps may have contained sensitive data. This estimate is also a Claroc claim that has not yet been independently verified. It has likewise not been confirmed whether another person or organization accessed sensitive data before the research was published.

What Grok Build users should check

For organizations using Grok Build apps, the findings point to a need to review the sharing rules for existing published tools. Given the discoverability of the addresses, apps set to “Anyone with the link” should be considered potentially public.

• Check which apps have an address assigned on grok.me.
• Verify the access mode for each app, especially the “Anyone with the link” option.
• Assess whether apps handle internal, personal, or health data.
• For sensitive tools, restrict access to an author-only mode or another appropriately managed mode.

Further developments will depend on whether SpaceXSI publishes its own security notice, changes the default sharing settings, or adds organizational access controls. It also remains open whether third-party access to the exposed data will be confirmed and whether the affected organizations will make any notifications to regulators.

Verified and updated: November 11, 2026, 15:26