Security firm Claroc says 35,578 apps published with Grok Build, the chat-based app builder in SpaceXSI's Grok assistant, opened to anyone without a sign-in, and that an estimated 650 to 800 of them contained private business or personal data. SpaceXSI is the company formerly called xAI. Claroc published the research on November 10, 2026.
Grok Build publishes each app to its own hostname under grok.me. Claroc says the publish step on its paid account preselected "Anyone with the link" as the access setting, although creators still had to click publish. Because each app gets its own hostname, the names show up in passive DNS data, so anyone with a commercial passive DNS account can pull the list and open the apps without guessing.
“AI app builders turned publishing into one click, and the default answer to who can see it is everyone”— Asaf Aprozper, Claroc Research
Claroc says a passive DNS service listed 43,601 names under grok.me, and it pulled the full listing on November 8 after daily queries starting October 31. Of 43,551 distinct apps it loaded, 35,578 opened without sign-in, or 94.7% of those that responded, while 1,993 returned an authentication error. Claroc says it requested only each app's first page, with no account, and did not submit forms or use any credentials it saw.
Key facts
- 01Claroc found 35,578 Grok Build apps that opened without sign-in, 94.7% of the apps that responded.
- 02Claroc estimates 650 to 800 of those apps contained private business or personal data; 150 exposures were confirmed by hand.
- 0324 exposed apps were built by SpaceXSI and X staff, including sales plans and advertising proposals; SpaceXSI took them down.
- 04Claroc says Grok Build's publish step preselected "Anyone with the link" and app hostnames appear in passive DNS data.
- 05Claroc reported the issue to SpaceXSI on November 8 and 9, 2026, and published its research on November 10.
An AI model graded the saved pages and flagged 3,477 as holding private material. After a stricter second pass and a random check of 100 apps, Claroc put the true figure at roughly 650 to 800. It confirmed 150 exposures by hand and says the real number is higher, because most apps fetch their records after the first page loads.
Twenty-four of the open apps were built by SpaceXSI and X staff. Claroc describes an enterprise sales onboarding plan marked confidential, a sales territory map covering 594 strategic accounts with pipeline data, X advertising proposals including one to a U.S. federal agency, and live advertiser account boards showing campaign spend.
Claroc also identified apps from 30 other organizations without naming them. Examples include a hospital group staff app with a roster of more than 3,500 employees, an ICU patient briefing with lab and imaging results, a fire department shift board, a trucking firm's list of more than 1,000 driver candidates, and a contractor timesheet whose code held 18 accounts with plain-text passwords. Claroc says 26 of the 30 organizations have more than 1,000 employees and six are in the Fortune 500.
In a separate test on its own app, Claroc built a team customer list with Google and X sign-in buttons. It says a Google account that had never been invited could read, edit and delete every record, because the generated app added the signed-in visitor to the team before checking membership. Claroc says it ran this test only on its own app.
SpaceXSI told a reporter on November 10 that Grok apps are private until shared, that publishing takes several steps, and that employee accounts default to "Only you." Claroc says it reported the issue to SpaceXSI on November 8 and 9, and that SpaceXSI then took down the 24 staff-built apps but not apps from other Grok users. Claroc says SpaceXSI had not replied to its own report as of November 10.
Claroc proposed four fixes: serving shared apps on a hard-to-guess path under one host, adding an organization-only sharing option, making "Only you" the default, and warning at publish time when an app has a database but no sign-in. Its tests found that choosing "Only you" blocked outsiders, and it says it has begun emailing affected organizations directly, reaching three by publication.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
