More than 35,000 apps built with Grok, the AI assistant made by SpaceXSI (formerly xAI), could be opened by anyone who found their address, according to research published on November 10, 2026, by security firm Claroc. Among them were 24 apps built by SpaceXSI and X staff, including a confidential onboarding plan, a sales territory map and advertising proposals.
Claroc says the problem is not a single bug but a default. In the paid account it tested, Grok’s publish step came with Anyone with the link already selected.
94.7% of live apps answered without a login
Grok’s Build mode lets people describe an app in chat and publish it to its own address under the grok.me domain. Between November 8 and 10, Claroc tried 43,551 of those addresses and found 37,571 still online. Of those, 35,578 (94.7%) opened for anyone with no sign-in. Only 1,993 returned an access error.
Most open apps were games, landing pages and calculators. Claroc estimates about 1 in 10 held internal business or personal data, roughly 2% held material it rated high or critical, and around 650 to 800 apps held private data in total.
Examples the researchers confirmed by hand include:
- A hospital group’s staff app with a searchable roster of more than 3,500 employees.
- An intensive care briefing for a single patient, with lab results, imaging and ventilator status.
- A fire department’s live shift board with names, badge numbers and duty hours.
- A trucking firm’s driver-recruiting list of more than 1,000 people with legal names and personal email addresses.
- A contractor’s timesheet app whose script file held 18 staff accounts with plain text passwords, including admins.
Besides SpaceXSI and X, Claroc identified internal data from 30 organizations, 26 of them with more than 1,000 employees and 6 in the Fortune 500. It did not name them.
SpaceXSI’s own staff apps were open too
The 24 apps tied to SpaceXSI and X staff included a confidential onboarding plan for a new enterprise sales hire, listing internal systems and 19 internal chat channels, a territory map of 594 strategic accounts and their pipeline, 8 X advertising proposals and media plans, 4 live advertiser account boards and 7 campaign reports. One proposal, marked confidential, was addressed to a U.S. federal agency.
Claroc reported the issue to SpaceXSI on November 8 and the remaining staff apps on November 9. SpaceXSI took down the 24 staff apps after the report, but the researchers say it has not done the same for other users’ open apps.
How anyone could find the links
Every published Grok app gets its own hostname. Claroc explains that the first time someone opens one, the DNS lookup can land in commercial passive DNS datasets that anyone with an account can search by pattern. That means an address meant only for a few colleagues can become discoverable without anyone sharing it.
The researchers also built 2 test apps with made-up data. A contact list app got a database with no sign-in, so any visitor could add records. A team customer list got Google and X sign-in buttons, but the code Grok wrote added anyone who signed in to the team before checking if they belonged. An outside Google account could view, edit and delete records. Claroc says it tested write access only on its own apps.
What SpaceXSI says
Responding to questions from a reporter, SpaceXSI said Grok apps stay private until the creator chooses to share one, and that publishing takes several steps, including picking between Only you and Anyone with the link and accepting a legal disclaimer. It said employee accounts default to Only you.
Claroc disputes that the extra steps protect users, noting that every one of the 35,578 open apps went through them. It asked SpaceXSI to make Only you the default, add an organization-only sharing option, serve apps on hard-to-guess paths rather than unique hostnames, and warn builders when an app has a database but no sign-in.
This is not the first privacy concern around Grok’s building tools. In July, researchers found that Grok Build uploaded entire Git repositories to xAI storage by default. AI platforms have also faced direct attacks, such as the recent NEAR AI data breach.
Check your organization’s Grok apps
- Ask teams which AI app builders they use. Tools like Grok need no admin rollout or company account.
- Open any internal Grok app in a private browser window. If it loads without a sign-in, switch its access to Invited users or Only you.
- Test sign-in with an account from outside your company. If it gets in, the app needs an allow list.
- Search app script files for names, emails and passwords, and unpublish apps nobody owns. Rotate any passwords that appeared in an app.
Read Claroc’s full GhostShares report for its method and recommendations. SpaceXSI had not issued any public statement on the findings at time of publication.
