Aprozper’s passive DNS search returned 43,601 links ending in grok.me. More than 35,000 of these were public, meaning nearly 95 percent allowed anyone to click and view the app data. He reported that tests over the past week showed Grok sets links to "Anyone with the link" by default. Users can change this setting to "invited users" or "only you," but Aprozper found that Grok Build required manual changes in all cases to prevent exposure. This default configuration contradicts statements from Cursor, which recently acquired SpaceXSI.
The Default Setting Problem
A Cursor representative stated in an email that Grok Build apps are private by default and nothing goes public unless the creator chooses to share it. However, Aprozper’s tests directly contradict this claim. In every instance, he had to manually switch the sharing permission to protect the data. The representative also noted that competing agents like ChatGPT, Lovable, and Bolt give users the ability to generate shareable links. While true, Aprozper argued that Grok is where they found by far the most sensitive company data. Other platforms like Claude, ChatGPT, and Gemini use secret randomness in the path, so DNS never sees the link structure. This architectural difference keeps their data hidden even if DNS records are exposed.
Risk for Other Platforms
Aprozper warned that people using other platforms are also at risk of exposing sensitive data through shared links. App builders including Lovable, Bolt, and Replit give each app its own web address, so the same DNS records expose them too. The Cursor representative did not respond to follow-up questions about whether SpaceXSI intentionally exposed proprietary internal information. They also did not explain why the company removed the data after Ars asked about it. Furthermore, no one confirmed if SpaceXSI planned to notify customers who exposed similar types of information. Anyone using shareable links with Grok Build should choose the "invite others" option unless they intend to make an app widely available. This simple step prevents accidental leaks of confidential business data.
