Grok Build Coding Agent Exposes Public Apps and Sensitive Corporate Data
A passive DNS search uncovered tens of thousands of publicly accessible Grok Build links, revealing sensitive company data due to permissive link-sharing defaults.
A security analysis of web addresses generated by the Grok Build coding agent has revealed tens of thousands of publicly accessible deployments, many containing confidential corporate records. A passive DNS discovery conducted by an investigator named Aprozper identified 43,601 domain records ending in grok.me. Further inspection showed that more than 35,000 of these links—approaching 95 percent of the total—were completely open to the public, allowing anyone who accessed the address to view the associated application along with whatever internal data it contained.
The findings spotlight how sharing mechanisms and default access permissions inside automated coding tools can inadvertently broadcast sensitive environments across the wider internet.
DNS Discoverability and Disputed Defaults
According to testing conducted by Aprozper over the course of a week, Grok Build assigns link-sharing permissions to "Anyone with the link" by default. While users have the ability to restrict this setting to either "invited users" or "only you," the platform's default workflow leaves deployments open unless the creator manually changes the permission state.
This behavior contrasts directly with statements from Cursor, an AI coding service recently acquired by SpaceXSI. A Cursor representative claimed via email that Grok Build deployments "are private by default and nothing goes public unless the creator chooses to share it." The spokesperson also pointed to competing AI developer tools—including ChatGPT, Lovable, and Bolt—noting that they similarly grant users the ability to create shareable links.
However, Aprozper's independent testing directly contradicted the representative's claims. In every test case, Grok Build required developers to proactively modify the "anyone with the link" setting to prevent external visibility. Following inquiries regarding whether SpaceXSI intentionally exposed proprietary internal files, why the data was taken down after being questioned, and whether affected users would be notified, the representative did not provide answers.
Subdomain Exposure Versus Path-Based Security
The vulnerability stems not merely from open settings, but from how platforms architect their shareable links. Aprozper pointed out that other popular application generators—including Lovable, Bolt, and Replit—also assign distinct subdomains and individual web addresses to each generated project. Because these unique names appear in public DNS records, passive DNS indexing exposes them in the same manner. Nevertheless, Aprozper noted that Grok Build was where by far the most sensitive corporate data was located.
In contrast, other major AI platforms handle link-sharing through an entirely different architecture that keeps URLs out of DNS tables. Systems like Claude's published artifacts (claude.ai/public/artifacts/), ChatGPT's shared conversations (chatgpt.com/share/), and Gemini (gemini.google.com/share/) isolate secret identifiers inside the URL path rather than generating unique hostnames. Because the random tokens reside within the path, DNS servers never log or expose them to passive monitoring.
What it means for developers
For engineering teams and independent creators utilizing AI-assisted software generation, this discovery highlights the need for careful configuration when deploying and testing web applications.
First, teams working with Grok Build should immediately audit their project permissions. Unless the explicit goal is to distribute a project to the general public, developers should configure their link settings to "invited users" or restrict them to "only you." Relying on perceived obscurity is ineffective when subdomains are registered and discovered via passive DNS inspection.
Second, developers must recognize that tools like Lovable, Bolt, and Replit share this DNS-exposed addressing model. Even if an address is not intentionally published on social media or search engines, generating a project with its own subdomain can leave internal records exposed to passive network monitoring.
For teams evaluating different generative tools without wanting to manage fragmented security configurations, developers can try top AI models cheaply through one API at https://apixoai.online, which simplifies how engineering pipelines connect to models like Grok, Claude, and GPT. Ultimately, when working in standalone coding sandboxes, treating every generated application as potentially public by default is the safest posture until access controls are verified.
Source: Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI — Ars Technica AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
