Security firm finds nearly 95 percent of Grok-built apps open to the public
Claroc, a security company, discovered that almost all web applications created with the AI assistant Grok can be accessed without a login. The scan of over 37,000 apps revealed patient records, internal SpaceXSI documents, and plaintext passwords.
The report details how 35,578 of the 37,571 active applications checked by Claroc were publicly accessible. This represents 94.7 percent of the total. The issue stems from a default setting in the publishing process that selects “Anyone with the link” before a user can change it.
Each app receives a unique subdomain on grok.me. These addresses appear in commercial passive DNS databases after the first visit. Researchers can search these databases by pattern to locate the exposed applications.
SpaceXSI employees exposed internal documents too
Twenty-four of the accessible apps were created by employees of SpaceXSI and X. Among the exposed materials was a confidential onboarding plan for a new enterprise sales team member. This document contained internal system addresses and 19 chat channels.
A publicly accessible sales territory map revealed 594 strategic accounts and pipeline data. The data also included eight X ad proposals, one of which targeted a U.S. federal agency and was marked as confidential. Campaign reports and dashboards showing ad spending were also made available.
Most of the open applications were games, landing pages, or calculators. About one in ten contained sensitive material, internal business data, or personal information. Claroc classifies roughly two percent of the cases as especially bad. Researchers estimate that 650 to 800 apps contained private data.
Confirmed cases included an ICU briefing with a patient’s lab values, a list of more than 3,500 employees at a hospital group, and a fire department shift schedule. The source code of a timesheet application contained 18 accounts with plaintext passwords. Beyond SpaceXSI and X, Claroc identified 30 affected organisations, six of them Fortune 500 companies. The firm is withholding the names.
Grok test app let an outside account join the team
Two of Claroc’s own test apps turned up another problem. A contact list application ended up with a database that had no login, allowing anonymous visitors to add entries. For a sales team customer list, Grok added Google and X sign-in options on its own.
In that test app, Grok’s code added every authenticated user to the team first and only checked membership afterward. An outside Google account could then read, edit, and delete records. Claroc says it ran write and delete tests only on its own apps.
Grok does offer the right settings. When set to “Only you,” the test app blocked outside access. It just isn’t the default. In a test with ChatGPT, a newly built app defaulted to “Only me” when shared. That app’s address can also show up in DNS data, but it leads to an application only the owner can open.
SpaceXSI says publishing takes several steps
SpaceXSI responded to the disclosure by stating that applications are private until their creator shares them. The company noted that publishing takes multiple steps including a legal notice, and that employee accounts default to “Only you”. Claroc counters that extra clicks do not help if “Anyone with the link” is still preselected at the final step. The 24 open employee apps also show how little the stricter default for staff accounts actually helps.
Claroc proposed that SpaceXSI make “Only you” the default and show who will have access before publishing. Grok should also warn when an application has a database but no login. Instead of individual subdomains, applications should run on hard-to-guess paths on a shared host so their names do not end up in DNS data.
SpaceXSI has since taken the 24 employee applications offline but has not removed the open applications from other Grok users and organisations. Claroc offered to share the full list of addresses confidentially. Because SpaceXSI did not commit to contacting the affected owners, Claroc is now notifying them directly. The firm has its own interests here. It sells security solutions for AI-built applications.
This is at least the third privacy incident for SpaceXSI involving Grok. In August 2025, Forbes found more than 370,000 shared Grok conversations in Google Search. In July 2026, the terminal tool Grok Build uploaded user files to the company’s servers without asking, including SSH keys and password databases. Because of sexualised deepfakes generated by Grok, Ireland’s data protection authority is also investigating whether X neglected data protection by design.
Other providers have similar problems with their sharing features. Using the same passive DNS method, Claroc tracked down about 6,800 shared conversations from Meta’s agent Muse in October. At Anthropic, shared Claude chats and artifacts turned up in search engines in July, including user-built applications.
What it means
For people building applications with Grok, the default risk is high. The software assumes a user wants the app public unless they actively change a setting. This creates a situation where a single click can expose a database to anyone with the link. The company has since tightened defaults for staff accounts, but existing applications remain vulnerable until the owners manually update them.
