Apps built with the AI assistant Grok are almost always open to anyone with the link, according to a security firm. The exposed data includes patient records and confidential documents from Grok maker SpaceXSI itself.
Security firm Claroc found more than 35,000 Grok-built apps that could be accessed without login, according to a recent report. In SpaceXSI's "Build" mode (the company was formerly xAI), users describe an app in a chat and Grok writes the code. An app only goes public when its creator clicks "Publish," which gives it its own address on grok.me.
Out of 37,571 apps Claroc checked that were still online, 35,578 were open to anyone. That's 94.7 percent, according to the report. Claroc points to the publish dialog as the cause. On the paid account the firm used for testing, "Anyone with the link" was already preselected. The addresses were also easy to find. Each app gets its own subdomain, so its name shows up in commercial passive DNS databases after the first visit. Those databases can be searched by pattern.
Each published app gets its own subdomain, which lands in searchable passive DNS databases after the first visit. | Image: Claroc
SpaceXSI employees exposed internal documents too
24 of the accessible apps came from SpaceXSI and X employees. Among them was a confidential onboarding plan for a new enterprise sales team member that included internal system addresses and 19 chat channels. Claroc also found a publicly accessible sales territory map with 594 strategic accounts and pipeline data, plus eight X ad proposals. One of those proposals targeted a U.S. federal agency and was marked as confidential. Campaign reports and dashboards with ad spending were also exposed.
The sales territory map assigns 594 strategic accounts to six territories and ranks them by priority. | Image: Claroc
Most of the open apps were games, landing pages, or calculators, Claroc says. But about one in ten contained sensitive material, internal business data, or personal information. The firm classifies roughly two percent as especially bad. The researchers estimate that 650 to 800 apps contained private data.
Confirmed cases included an ICU briefing with a patient's lab values, a list of more than 3,500 employees at a hospital group, and a fire department shift schedule. The source code of a timesheet app contained 18 accounts with plaintext passwords. Beyond SpaceXSI and X, Claroc identified 30 affected organizations, six of them Fortune 500 companies. The firm is withholding the names.
The script of a Grok-built timesheet app contained 18 accounts with plaintext passwords. | Image: Claroc
Grok test app let an outside account join the team
Two of Claroc's own test apps turned up another problem. A contact list app ended up with a database that had no login, so anonymous visitors could add entries. For a sales team customer list, Grok added Google and X sign-in on its own. In that test app, though, Grok's code added every authenticated user to the team first and only checked membership afterward. An outside Google account could then read, edit, and delete records. Claroc says it ran write and delete tests only on its own apps.
In Claroc's test app, the Grok-written code first added every authenticated visitor to the team and only checked membership afterward. | Image: Claroc
Grok does offer the right settings. When set to "Only you," the test app blocked outside access. It just isn't the default. In a test with ChatGPT, a newly built app defaulted to "Only me" when shared. That app's address can also show up in DNS data, but it leads to an app only the owner can open.
SpaceXSI says publishing takes several steps
SpaceXSI responded to the disclosure only by saying that apps are private until their creator shares them, that publishing takes multiple steps including a legal notice, and that employee accounts default to "Only you." Claroc counters that extra clicks don't help if "Anyone with the link" is still preselected at the final step. The 24 open employee apps also show how little the stricter default for staff accounts actually helps, the firm says.
Claroc proposed that SpaceXSI make "Only you" the default and show who will have access before publishing. Grok should also warn when an app has a database but no login. Instead of individual subdomains, apps should run on hard-to-guess paths on a shared host so their names don't end up in DNS data.
SpaceXSI has since taken the 24 employee apps offline but hasn't removed the open apps from other Grok users and organizations. Claroc offered to share the full list of addresses confidentially. Because SpaceXSI didn't commit to contacting the affected owners, Claroc is now notifying them directly. The firm has its own interests here. It sells security solutions for AI-built apps.
This is at least the third privacy incident for SpaceXSI involving Grok. In August 2025, Forbes found more than 370,000 shared Grok conversations in Google Search. In July 2026, the terminal tool Grok Build uploaded user files to the company's servers without asking, including SSH keys and password databases. Because of sexualized deepfakes generated by Grok, Ireland's data protection authority is also investigating whether X neglected data protection by design.
Other providers have similar problems with their sharing features. Using the same passive DNS method, Claroc tracked down about 6,800 shared conversations from Meta's agent Muse in October. At Anthropic, shared Claude chats and artifacts turned up in search engines in July, including user-built apps.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Subscribe now
原文版权归 The Decoder 及原作者所有，本站转载仅供阅读。如需删除，请联系 support@aisa.one。
Studio