Security firm Claroc found 35,578 of 37,571 live apps built with Grok's chat app builder opened without a sign-in, including 24 made by SpaceXSI and X staff. Grok proposes 'Anyone with the link' at publish, and app addresses leak through public DNS data. Switch internal apps to Invited users or Only you.
If anyone at your company built an app in Grok and published it, open it in a private browser window today. If it loads without asking you to sign in, so can a stranger. Security firm Claroc says 35,578 of the 37,571 live Grok-built apps it tested, 94.7%, opened for anyone, and about 1 in 10 held internal business or personal data.
What changed
Grok, the assistant from SpaceXSI (formerly xAI), can build a working app from a description typed into its chat, a feature opened to every Grok plan on August 19. Each published app gets its own web address under grok.me. In a report published November 10, Claroc says it found 43,601 such addresses using common subdomain discovery techniques and loaded each first page once, without signing in.
What it says it found, describing material by kind and naming no owners:
- SpaceXSI and X’s own apps. 24 were open, including a confidential onboarding plan for a sales hire, a territory map of 594 strategic accounts, and an X advertising proposal to a U.S. federal agency marked confidential. Only one SpaceXSI or X app asked for a password.
- Other organizations. Internal data from 30 identifiable organizations, 26 of them with more than 1,000 employees and 6 in the Fortune 500.
- Personal data. A hospital group’s searchable roster of more than 3,500 staff, an intensive care briefing on one patient, a fire department’s live shift board, and a timesheet app whose code held every employee’s password in plain text.
Claroc estimates roughly 2% of the open apps held material serious enough to rate high or critical, or about 650 to 800 apps with private data. The Hacker News and Engadget, citing Ars Technica, reported the same findings. Claroc sells security for AI-built apps, and its report ends with a sales pitch; the counts above are its own and have not been independently verified.
Why a random app name did not protect it
Nothing goes public until the builder clicks Publish. But in the paid account Claroc used, the next screen offered three access settings, “Anyone with the link,” “Invited users” and “Only you,” with “Anyone with the link” already selected.
The link was never secret anyway. Because each app is its own subdomain, the first time anyone opens it their computer looks the name up in DNS. Passive DNS services record those lookups and let paying customers search them by pattern. Grok suggests four random words as each app’s name, which is hard to guess and easy to list once it sits in that database.
SpaceXSI told a reporter that apps are private until their creator shares one, that publishing takes several confirmation steps, and that employee accounts default to Only you. Claroc says the 24 open staff apps show that default did not keep SpaceXSI’s own data in. SpaceXSI took those 24 down after the report; according to Claroc, it has not touched other users’ open apps or said it will contact their owners.
ChatGPT’s app builder also gives each app its own subdomain, but Claroc says new shares there start as “Only me.” Shared chats on Claude, ChatGPT and Gemini put the secret part of the link in the path, so it never reaches DNS.
Your team’s side projects are now your data exposure
These apps did real work: sales pipelines, staff rosters, customer lists. Bought as software, they would have come with company sign-in and an admin. Built in a chat window, they went live behind a link. Here is what to do:
- Find them. Ask your team who has published apps from Grok, Lovable, Replit, v0, Bolt, Base44 or Google AI Studio. None needs an admin rollout or a company account.
- Fix the setting. Any Grok app with internal data should be Invited users or Only you, and a stranger should get an error page.
- Test sign-in from outside. Claroc says a team app Grok built with “Continue with Google” let any Google account read, edit and delete records. If an outside account gets in, the app needs an allowlist.
- Unpublish what nobody owns. Claroc says unpublishing takes a grok.me app offline at once.
This is the second time in a few months that Grok Build has made the news for where data goes. The separate Grok Build coding tool for the terminal was reported in July to upload whole repositories, secrets included. Treat any AI builder like a new SaaS vendor: decide who may use it and what data it may hold before it becomes the place your team keeps both. For a password manager that hands agents scoped access instead of raw keys, see 1Password for agents.