Aprozper mentioned a passive DNS search returned 43,601 hyperlinks ending in grok.me. Of them, greater than 35,000, or practically 95 p.c, have been public, which means that clicking on the hyperlink opened the corresponding app and all knowledge it saved. He mentioned that exams he carried out over the previous week confirmed that, by default, Grok units hyperlinks to “Anybody with the hyperlink.” Customers have the choice to alter the setting to “invited customers” or “solely you.”
A consultant with Cursor, the AI coding service SpaceXSI lately acquired, mentioned in an e mail that Grok Construct “apps are non-public by default and nothing goes public until the creator chooses to share it.” The consultant mentioned that competing coding brokers from ChatGPT, Lovable, and Bolt additionally give customers the power to generate shareable hyperlinks.
Aprozper’s exams contradict the consultant’s assertion. In all circumstances, Grok Construct required customers to alter anybody with the hyperlink to one of many different two choices.
The Cursor assertion concerning different AI coding platforms is appropriate. Aprozper mentioned that app builders, together with Lovable, Bolt, and Replit, “additionally give every app its personal internet deal with, so the identical DNS information expose them, too. Nevertheless, Grok is the place we discovered by far essentially the most delicate firm knowledge.” That implies that folks utilizing these different platforms are additionally liable to exposing delicate knowledge via shared hyperlinks. Curiously, AI platforms that observe the proper sharing hyperlink follow embody Claude’s printed artifacts (claude.ai/public/artifacts/), ChatGPT’s shared conversations (chatgpt.com/share/), and Gemini (gemini.google.com/share/). For all three, the key randomness is within the path, so DNS by no means sees it.
The consultant didn’t reply to follow-up questions, together with if SpaceXSI deliberately uncovered the proprietary inside data, why the corporate eliminated the information after Ars requested about it, and if it deliberate to inform prospects who additionally uncovered comparable sorts of data. Anybody utilizing shareable hyperlinks with Grok Construct ought to select the “invite others” possibility until they intend to make an app broadly out there.