Researchers at the security firm Claroc visited tens of thousands of apps made with Grok’s Build mode, the feature where you describe an app in chat and Grok writes it, and 35,578 of them opened without any login. That is 94.7 percent of the 37,571 apps that were still live when Claroc checked. Some belonged to staff at SpaceXSI (which used to operate as xAI) and at X, and one was a medical briefing about a single intensive care patient.
Claroc Research’s Asaf Aprozper and his colleagues published the findings on the company blog on 10 November. Every app published from Grok gets its own address under grok.me, they explain, and the first time anyone opens it, the lookup lands in passive DNS data, a commercial index that customers can search by pattern. The team used standard subdomain discovery to list 43,601 names, fetched each front page a single time from the open internet, and studied the saved copies afterwards.
Most of what they found was harmless: games, landing pages, calculators. Roughly one app in ten held internal company records or personal details, and Claroc estimates about 2 percent were serious enough to be rated high or critical. Checked by hand were an event app run by a hospital group that listed thousands of its employees, a patient briefing with lab results, imaging and ventilator readings, a fire department’s live duty roster, and a contractor’s timesheet app whose code held 18 accounts and their passwords in readable text. Thirty other organizations had internal data exposed in apps that revealed their owner. Twenty-six employ over a thousand people, and six sit in the Fortune 500. Claroc names none of them and published no addresses.
The SpaceXSI and X material is the part that stings. Claroc counted 24 open apps built by the company’s own staff. They included a confidential onboarding plan for a new enterprise sales hire, a territory map covering 594 accounts, eight advertising proposals (one for a federal agency in the United States, marked confidential), and four advertiser boards showing campaign spend.
Claroc also built two apps of its own, using invented data, to see what Grok does when the builder never mentions security. The contact list got a database and no login, and an incognito visitor could add a row. The team customer list got Google and X sign-in, but the generated code put every signed-in person on the team before checking whether they belonged, so a Google account that had never been invited read, edited and deleted records. Claroc tested writes only on its own apps. Whether strangers could change the data in the open apps it found remains unproven.
The dispute is over the default. In the paid account Claroc used, the publish panel listed three audiences, and the widest one was already selected. Claroc says SpaceXSI told a reporter that apps stay private until their creator shares them, that publishing takes several steps ending with a legal disclaimer, and that employee accounts start out restricted to the owner. Claroc replies that every one of the 35,578 builders clicked through those same steps, and that SpaceXSI’s own staff still ended up with 24 public apps. In Claroc’s test of ChatGPT’s app builder, sharing began restricted to the owner.
Claroc says it contacted SpaceXSI on 8 November, then sent the remaining 22 staff apps on 9 November. As of 10 November, by Claroc’s account, SpaceXSI had not answered the report, though it did respond to a reporter’s questions and took down the 24 staff apps. It has not said it will reach the owners of the rest, so Claroc began emailing affected organizations itself and had reached three at the time of writing. The firm describes the default as a design choice SpaceXSI defended, not a bug the company promised to fix.
Claroc sells software that finds and locks down AI-built apps, and its post closes with an offer of a 30-minute exposure check. The counts come from its own scans, with an AI model flagging suspect pages and people confirming them, and SpaceXSI has not published a rebuttal. The pattern is still easy to believe, since one publish button serves a lunch poll and a sales pipeline alike.
Any company whose staff publish from Grok can run the test this afternoon: open each app address in a private browser window, and if the page loads, assume the data behind it is open too.
Reported by Claroc Research on its blog on 10 November 2026.
