Security company Claroc says it found more than 35,000 apps built with Grok, the AI assistant from SpaceXSI (the company formerly called xAI), that anyone with the link could open without signing in. Grok can write a working app from a description typed into its chat, and each published app gets its own address under grok.me. Of 37,571 apps still online when Claroc tried them, 35,578 (94.7%) opened for anyone; only 1,993 answered with the error an app set to “Only you” or “Invited users” returns. Most were games, landing pages and calculators, but Claroc estimates about one in ten held internal business or personal data and roughly 2% held material serious enough to rate high or critical.
Among them were 24 apps built by SpaceXSI and X staff, including a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts and an X advertising proposal to a U.S. federal agency marked confidential. Claroc also identified internal data from 30 other organizations (26 with more than 1,000 employees, six in the Fortune 500), including a hospital group’s searchable list of more than 3,500 employees, an intensive-care briefing for a single patient, a fire department’s live shift board and a contractor’s timesheet whose code contained every employee’s password in plain text. SpaceXSI took down the 24 staff apps after the report; Claroc says it has not done the same for other users’ and organizations’ apps.
The apps were findable because each address is a hostname. When anyone opens one, their computer looks the name up in DNS, and passive-DNS services record those lookups and let account holders search them by pattern. Claroc says Grok suggests four random words as an app’s name and about half the names it saw followed that pattern, which is hard to guess but does not help once the name is in a searchable list. In the paid account Claroc used, the publish panel offered “Anyone with the link”, “Invited users” and “Only you”, with “Anyone with the link” already selected. The illustration of the publish sheet in Grok’s launch post also shows the Access field set to “Anyone with the link”. Claroc says ChatGPT’s app builder, in its test, set shared apps to “Only me” until changed.
SpaceXSI’s answer, as relayed by Claroc, is that apps are private until the creator chooses to share one, that publishing takes several steps ending in a legal disclaimer, and that employee accounts default to “Only you”. Claroc replies that people who published the open apps went through those steps too, and that the 24 staff apps were open despite that default. Claroc also built two test apps with made-up data and published them with the proposed setting. An app Grok built to save contacts had a database but no sign-in, and a visitor with no account could add a row that the next visitor saw. In a customer-list app for a four-person team, Grok added “Continue with Google” and “Continue with X” sign-in, but Claroc says the code added whoever signed in to the team before checking whether they were on it, so a Google account that had never been invited could view, change and delete records. Claroc says it tested this only on its own apps. The Hacker News adds that this chat-based builder shares the Grok Build name with a separate terminal coding tool whose repository uploads were reported in July.
How to check if you’re affected
Affected products are apps published through Grok’s chat-based app builder on grok.me. Steps below follow Claroc’s guidance.
- Open the app’s access setting. An app holding anything internal should say “Invited users” or “Only you”. Claroc says a stranger should get an error page, so check by opening the address in a private window while signed out.
- If the app has sign-in, test it with an account from outside your organization. If that account gets in, the app needs an explicit list of who may use it.
- Look at the app’s script files for names, emails and passwords, and unpublish anything nobody owns; Claroc says unpublishing takes a grok.me app offline within seconds.
- For organizations: Claroc suggests finding which AI app builders your people use (it names Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio) and, if you have passive-DNS access, searching it for the builders’ domains and opening what you find in an incognito window.