Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant.

Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or personal data.

Staff Apps Exposed Confidential Data

The staff apps included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential.

SpaceXSI, formerly known as xAI, has since taken down all 24 staff apps but not other users' apps, the researchers said.

Besides those staff apps, the open apps contained internal data from 30 other organizations the researchers could identify, across fields ranging from construction and energy to healthcare and defense. Of those, 26 have more than 1,000 employees, and 6 are Fortune 500 companies.

According to the researchers' estimate in their report, roughly 2% of the open apps contained material serious enough to rate as high or critical. The exposed material included a hospital group's searchable list of more than 3,500 employees, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet whose code held every employee's password in plain text.

How Grok App Building and Publishing Works

Grok can build a working app from a description typed into its chat, a feature its maker opened to every Grok plan on August 19. This chat builder shares the Grok Build name with a separate terminal coding tool, whose repository uploads were reported on July 14.

Each published app gets its own subdomain of grok.me, and its creator chooses who can open it, according to the company's launch announcement. No app goes public until its creator clicks Publish.

In the paid account the researchers used, the next step offered 3 access settings:

• "Anyone with the link"
• "Invited users"
• "Only you"

"Anyone with the link" was already selected.

Why App Addresses Do Not Stay Secret

The setting matters because an app's address does not stay secret, the researchers say. Opening an app makes the visitor's computer look up its subdomain in DNS. Passive DNS services record such lookups, and anyone with an account can search those records by pattern.

Grok suggests 4 random words as each app's name, and about half of the names the researchers found followed that pattern. Such names are hard to guess, but that does not protect an app whose name already sits in a searchable list.

ChatGPT's app builder also puts each app on its own subdomain. But when the researchers shared an app there, its access was set to "Only me" until they changed it. A ChatGPT app address found in DNS data would lead to an app that only its owner can open, they say.

The researchers found the Grok app names using common subdomain discovery methods and loaded each app's first page once, without signing in.

Researchers' Tests of Grok's Default Protection

To see what protection Grok adds on its own, the researchers built 2 test apps with made-up data and published both with the access setting already selected, "Anyone with the link".

The first, a contact list, got a database but no sign-in. Without signing in, the researchers added a row from a private browser window, and the next visitor saw it.

The second, a customer list for a 4-person sales team, got sign-in buttons that Grok added on its own: "Continue with Google" and "Continue with X". But the code Grok wrote added each person who signed in to the team before checking whether they belonged, so the check always passed. An uninvited Google account belonging to someone other than the owner got in, viewed every customer, edited one record, and deleted another.

The researchers ran these tests only on their own apps. They did not test whether any of the open apps they found would accept such changes.

Disclosure to SpaceXSI

The researchers reported their findings to SpaceXSI on Sunday through the address in its security.txt file, including 2 of the staff apps. They reported the other 22 on Monday.

By the time the researchers published yesterday, the company had not replied to their report, but it had answered a reporter's questions about the research.

As the researchers describe, the company said Grok apps stay private until their creator shares them. Publishing takes several steps, including choosing between "Only you" and "Anyone with the link," as well as a legal disclaimer. Employee accounts are set to "Only you" by default. Even so, 24 apps built by staff at the company and at X were open to anyone, the researchers say.

With their report, the researchers had asked the company to make "Only you" the default and to add an option that limits an app to a company's own email domain. The company's response did not state that it would contact the owners of other open apps, according to the researchers. They have started emailing the affected organizations themselves and had emailed 3 by the time they published. They withheld every app address and title from the report.

On October 18, the same researchers published Muse research showing that pages shared from Meta's Muse AI agent could be found through passive DNS. Meta disabled sharing, then announced a sharing fix on October 22 that gave shared items new addresses.

How to Check Your Organization's Grok Apps

Claroc, which sells tools to find and secure apps built with AI, recommends these checks:

• Find out which AI app builders your staff uses. Builders such as Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio can be used without IT setting them up or a company account.
• If you have access to passive DNS data, look up the builders' domains and open any results in a private browser window.
• Make sure any Grok app with internal data is set to "Invited users" or "Only you", and that a stranger gets an error page.
• Try to sign in with an account from outside your company. If it gets in, the app needs a list of who is allowed.
• Check the scripts each app loads for names, email addresses and passwords, and unpublish apps that have no owner.

In the researchers' tests, setting an app to "Only you" caused it to return a 401 error to a stranger for both the page and its data, and unpublishing took an app offline within seconds.