Claroc: 95% of 37 Thousand Apps Built in Grok Are Open to Anyone Without a Login

Imagine you spend an evening building an internal tool for your department, click “Publish” and go to bed. In the morning you find that anyone who knows the address can open it. And the address isn’t hard to find. That, roughly, is the story told by security firm Claroc about apps created in Grok.

What the researchers found

In Build mode at SpaceXSI (formerly xAI), a user describes an app in a chat and Grok writes the code. The app becomes public after the “Publish” button is pressed, and it then gets its own address on grok.me. Claroc checked 37 571 apps that were still online. 35 578 of them opened without any login. That is 94.7%.

Most are harmless games, landing pages and calculators. But roughly one in ten contained sensitive data: internal business materials or personal information. The researchers classified about 2% as especially serious cases and estimated that 650–800 apps held private data.

Examples of confirmed findings:

• an ICU summary with a patient’s lab values;
• a list of more than 3500 employees of a hospital group;
• a fire station’s shift schedule;
• the source code of a time-tracking app with 18 accounts and plaintext passwords.

Thirty organizations besides SpaceXSI and X are affected, six of them from the Fortune 500. Claroc does not disclose their names. Among the 24 open apps built by employees of SpaceXSI and X itself were a confidential onboarding plan for a corporate sales manager, a territory map with 594 strategic customers and eight advertising proposals for X. One of them is addressed to a US federal agency and marked confidential.

Why this happened

According to Claroc, there are three causes. First: in the publish dialog on a paid test account, the “Anyone with the link” option was already selected. A person in a hurry simply doesn’t change the preselected choice. Second: every app has its own subdomain, so after the first visit its name lands in commercial passive DNS databases, where it can be searched by pattern. A link that was never shown to anyone stops being secret.

The third cause is the code the model itself writes. In one test app, a contact list’s database turned out to have no authorization, and anonymous users could add records. In another, a customer database for a sales team, Grok wired up Google and X sign-in on its own. But the logic was inverted: every user who signed in was first added to the team, and only then was membership checked. Any outside Google account could read, edit and delete records. Claroc says it ran write and delete tests only on its own apps.

Grok does have the right settings: with “Only you” selected, the system kept outsiders out. It just isn’t the default. In a similar test with ChatGPT, a freshly created app got “Only me” by default when shared. The address can also leak into DNS, but only the owner can open it.

What to keep in mind

A caveat up front: Claroc sells security solutions for AI-built apps, so the firm has an interest here. Still, the mechanics of the problem can be verified and do not depend on the report’s motives. SpaceXSI’s response said only that apps are private until the owner shares them, that publishing takes several steps, including a legal notice, and that employees default to “Only you.” Claroc objects: extra clicks are meaningless if “anyone” is still selected at the last step. And the 24 open employee apps show that a strict default for staff doesn’t help. The company disabled those 24 apps; the rest stayed open. So Claroc is notifying the owners itself.

The practical takeaways are simple:

• Before publishing any generated app, check the access mode manually; don’t trust the default.
• Don’t put real customer, patient or employee data into vibe-coded apps until you have verified authorization.
• Read the access-check code: the “add, then check” order is a classic mistake, and the model reproduces it.
• If you are building your own product with app publishing, use a private default, unpredictable paths on a shared host instead of subdomains, and a warning like “there is a database but no login.” That is exactly what Claroc recommends.

This is at least the third privacy incident involving SpaceXSI and Grok: in August 2025, Forbes found more than 370 000 shared conversations in Google, and in July 2026 the terminal Grok Build uploaded users’ files, including SSH keys, without asking. Others have sharing problems too: using the same method, Claroc found about 6800 shared Meta Muse conversations, and in July, Claude chats and artifacts surfaced in search for Anthropic. The shared lesson for the industry: the “Share” button in an AI product is a security surface, not just UX.