Aprozper said a passive DNS lookup returned 43,601 links ending in grok.me. Of those, more than 35,000, or almost 95 percent, were public, meaning that clicking the link opened the corresponding application and all the data it stored. He said tests he ran over the past week showed that, by default, Grok links to “Anyone with the link.” Users have the option to change the settings to “guest users” or “only you.”
A representative for Cursor, the AI coding service that SpaceXSI recently acquired, said in an email that Grok Build “apps are private by default and nothing is made public unless the creator decides to share it.” The representative said that competing encryption agents ChatGPT, Lovable and Bolt also provide users with the ability to generate shareable links.
Aprozper’s evidence contradicts the representative’s statement. In all cases, Grok Build required users to switch to anyone with the link to one of the other two options.
Cursor’s claim about other AI coding platforms is correct. Aprozper said that app makers including Lovable, Bolt and Replit “also give each app its own web address, so the same DNS records expose them as well. However, Grok is where we find by far the company’s most sensitive data.” That means people using these other platforms also run the risk of exposing sensitive data through shared links. Interestingly, AI platforms that follow the correct link sharing practice include Claude’s published artifacts (claude.ai/public/artifacts/), ChatGPT’s shared conversations (chatgpt.com/share/), and Gemini (gemini.google.com/share/). For all three, the secret randomness is in the path, so DNS never sees it.
The representative did not respond to follow-up questions, including whether SpaceXSI intentionally exposed internal proprietary information, why the company deleted the data after Ars asked about it, and whether it planned to notify customers who also exposed similar types of information. Anyone using sharing links with Grok Build should choose the “invite others” option unless they intend to make an app widely available.
