Aprozper said a passive DNS search returned 43,601 links ending in grok.me. Of them, more than 35,000, or nearly 95 percent, were public, meaning that clicking on the link opened the corresponding app and all data it stored. He said that tests he conducted over the past week showed that, by default, Grok sets links to \u201cAnyone with the link.\u201d Users have the option to change the setting to \u201cinvited users\u201d or \u201conly you.\u201d<\/p>\n
A representative with Cursor, the AI coding service SpaceXSI recently acquired, said in an email that Grok Build \u201capps are private by default and nothing goes public unless the creator chooses to share it.\u201d The representative said that competing coding agents from ChatGPT, Lovable, and Bolt also give users the ability to generate shareable links.<\/p>\n
Aprozper\u2019s tests contradict the representative\u2019s statement. In all cases, Grok Build required users to change anyone with the link to one of the other two options.<\/p>\n
The Cursor statement regarding other AI coding platforms is correct. Aprozper said that app builders, including Lovable, Bolt, and Replit, \u201calso give each app its own web address, so the same DNS records expose them, too. However, Grok is where we found by far the most sensitive company data.\u201d That means that people using these other platforms are also at risk of exposing sensitive data through shared links. Interestingly, AI platforms that follow the correct sharing link practice include Claude\u2019s published artifacts (claude.ai\/public\/artifacts\/), ChatGPT\u2019s shared conversations (chatgpt.com\/share\/), and Gemini (gemini.google.com\/share\/). For all three, the secret randomness is in the path, so DNS never sees it.<\/p>\n
The representative didn\u2019t respond to follow-up questions, including if SpaceXSI intentionally exposed the proprietary internal information, why the company removed the data after Ars asked about it, and if it planned to notify customers who also exposed similar types of information. Anyone using shareable links with Grok Build should choose the \u201cinvite others\u201d option unless they intend to make an app widely available.<\/p>\n","protected":false},"excerpt":{"rendered":"Aprozper said a passive DNS search returned 43,601 links ending in grok.me. Of them, more than 35,000, or…\n","protected":false},"author":2,"featured_media":913048,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[45],"tags":[182,181,507,74],"class_list":["post-913047","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/913047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=913047"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/913047\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/913048"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=913047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=913047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=913047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}