Concerns Raised Over Data Privacy in Grok Build Apps
A recent analysis by cybersecurity expert Aprozper revealed significant privacy concerns related to Grok Build, a platform utilized for creating applications. A passive DNS search identified a staggering 43,601 links associated with the domain grok.me, of which over 35,000—approximately 95 percent—were publicly accessible. This accessibility implies that anyone clicking these links could potentially access the corresponding app and all its stored data.
Default Settings Under Scrutiny
Aprozper noted that his investigations over the past week indicated that Grok Build defaults its link settings to “Anyone with the link.” Users can opt to modify this setting to “invited users” or “only you,” but the default configuration raises concerns about unintentional data exposure.
Contradicting Claims from Cursor
A representative from Cursor, an AI coding service recently acquired by SpaceXSI, contended in an email that Grok Build apps are inherently private and only become public if the creator decides to share them. However, Aprozper’s tests contradict this assertion; he found that users routinely needed to change the default setting to protect their data.
Comparative Analysis with Other Platforms
While the Cursor representative called attention to competitive coding tools from ChatGPT, Lovable, and Bolt—stating these platforms also allow for shareable link generation—Aprozper’s findings suggest parallels in potential data exposure. He acknowledged that app builders on platforms like Lovable, Bolt, and Replit can create web addresses for their apps, leaving sensitive company data at risk through shared links. However, he indicated that Grok Build had a notably higher incidence of sensitive data exposure.
Best Practices for Data Sharing
Interestingly, AI platforms such as Claude’s published artifacts, ChatGPT’s shared conversations, and Gemini have implemented more secure sharing practices. Aprozper noted that these services utilize a system where the randomized paths prevent DNS data leaks, thereby enhancing user data privacy.
Unanswered Questions from SpaceXSI
The Cursor representative has not responded to subsequent inquiries regarding whether SpaceXSI intentionally allowed the exposure of sensitive internal information, the removal of this data after questioning, or if there are plans to notify affected customers. Users engaging with shareable links on Grok Build are advised to select the “invite others” option to mitigate the risk of unintentional data breaches.
Discussion about this post