Most Grok-built apps open to anyone without sign-in, researchers find; some hold internal and patient data
Claroc found 35,578 of 37,571 live Grok Build apps open without sign-in, about 1 in 10 with internal or personal data. SpaceXSI pulled its own staff apps but kept the default.
Security firm Claroc reported on November 10, 2026 that 35,578 of the 37,571 live apps it found on Grok Build, the AI app builder from SpaceXSI (formerly xAI), opened for anyone without a sign-in. About one in ten held internal or personal data, including staff rosters, an ICU patient briefing and plaintext passwords. If people in your organization build apps with Grok or similar AI builders, check who can open them, and unpublish anything that holds internal data and isn't restricted.
What happened, in plain English
Grok Build lets anyone describe an app in a chat ("a shift board for my team", "a customer list") and publish it with a few clicks. Each published app gets its own web address on the grok.me domain, such as tiny-city.grok.me. SpaceXSI's own announcement says creators choose who can open a published app.
Claroc's researchers say that when they published, the access setting already had "Anyone with the link" selected. Many people seem to have kept it. That works for a game or a landing page. It doesn't work for a hospital staff list.
The link isn't as secret as it sounds. Every time someone visits an app, their computer looks up its address in DNS (the Domain Name System, the internet's phone book). Commercial "passive DNS" services record those lookups, so anyone with access to them can list every grok.me name that has been visited. An app name made of four random words is hard to guess, but once it's been looked up it's easy to find.
Think of it as an unlocked office whose street address was printed in a public directory the first time someone went there.
Claroc says it opened each app's first page once, without signing in to anything, and checked by hand which pages looked private. It reported the problem to SpaceXSI on November 8. SpaceXSI then took down 24 apps built by its own staff and X employees, but left the default and other users' apps as they were.
Are you affected? What to do now
Who is affected: organizations whose employees publish apps with Grok Build, and anyone whose data ended up in such an app. Claroc says it identified 30 organizations from the internal data, 6 of them in the Fortune 500. Most of the open apps were games, calculators and landing pages, with nothing sensitive in them. If nobody in your organization uses AI app builders, you have nothing to do on this specific issue.
The same risk applies to any AI builder that gives each app its own public subdomain. Claroc names Lovable, Replit, v0, Bolt, Base44 and Google AI Studio as tools to inventory, but it doesn't say those products are exposed in the same way.
Checklist:
- Find out who builds apps with AI. Ask teams directly, and check proxy or DNS logs for traffic to
grok.meand other builder domains. Pay special attention to HR, healthcare, sales and operations staff, who are the least likely to think of a quick app as "IT". - Open each app from outside. Use a private browser window, signed out. If you see data instead of an error or a sign-in page, the app is public.
- Restrict or unpublish. In Grok's publish settings, switch anything holding internal data to "Only you" or invited users. Claroc says "Only you" returned a 401 (access denied) error to outsiders. Unpublish apps that nobody owns anymore.
- Test the sign-in, not just the setting. Claroc found that a Google and X sign-in flow Grok wrote for its own test app admitted any account, invited or not, because the generated code added each new user to the team before checking the list. Try signing in with an account outside your organization. If it gets in, the app needs a real allow-list.
- Look for secrets in the page. Check the scripts the app loads for names, emails and passwords. One exposed timesheet app contained 18 employee accounts with plaintext passwords, administrators included. If you find credentials, change those passwords and treat them as exposed.
- Set a policy. Decide which AI builders are allowed, and require that apps holding company data use company sign-in.
No CVE (Common Vulnerabilities and Exposures) ID applies here. This is a default-setting and design problem, not a software bug with a patch, so there is no version to update.
The expert view
This isn't a memory-corruption bug or a broken authentication library. It's three ordinary decisions that add up to an exposure.
1. A permissive default at the moment of publishing. SpaceXSI told reporters that apps "are private until their creator chooses to share one." It said publishing takes several steps, including a legal disclaimer, and that employee accounts default to "Only you." Claroc doesn't dispute that nothing goes live before Publish is clicked. Its point is that the access choice inside that flow is pre-set to everyone: "Extra clicks on a path that ends with access already set to everyone do not protect the data." The fact that staff accounts get a safer default than ordinary users is a telling detail.
2. Capability URLs placed in the hostname. A long random link is a fair access control if it stays secret. Shared chat links from Claude, ChatGPT and Gemini keep their secret in the URL path, which never reaches DNS. Grok puts it in the subdomain, which DNS resolvers see and passive DNS sensors record. That turns "unguessable" into "searchable". The same researchers documented this pattern with Meta's Muse agent in October, and Meta changed how shared items are addressed on October 22, per The Hacker News.
3. Generated authorization logic that fails open. The sign-in finding should worry developers most. In Claroc's own test app, the AI-written code registered each user as a team member before checking membership, so the check could never fail. That's a classic order-of-operations bug, and the person who asked for "team-only access" has no realistic way to spot it in code they never read. It fits a pattern we keep seeing with AI-built software: the feature you asked for is there, but the security property you assumed isn't.
Severity in context. No CVSS (Common Vulnerability Scoring System) score applies. By Claroc's numbers, roughly 2% of open apps held high- or critical-sensitivity data. That's a small share, but a real absolute number, and it includes health and credential data. Claroc's manual sample estimated about 650–800 apps with private data. The bigger issue is organizational: these apps are shadow IT that never went through review, built by people who don't see themselves as developers.
What is still unknown:
- All figures are researcher-reported and not independently verified. Claroc, which sells AI app security tools, gives two slightly different counts for names discovered (43,551 and 43,601).
- Whether anyone malicious has already harvested these apps is unknown. Claroc says it withheld all addresses and titles.
- SpaceXSI hasn't said whether it will change the default, notify owners of other open apps, or move apps off per-app hostnames. Its statements came through reporters' questions, not a published advisory.
- The options Claroc saw in its paid account ("Anyone with the link", "Invited users", "Only you") differ slightly from those in SpaceXSI's August announcement ("just you, anyone with the link, or the whole internet"). Plans or versions may differ.