Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords Swati KhandelwalNov 11, 2026Artificial Intelligence / Data Security Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or personal data. The staff apps included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential. SpaceXSI, formerly known as xAI, has since taken down all 24 staff apps but not other users' apps, the researchers said. Besides those staff apps, the open apps contained internal data from 30 other organizations the researchers could identify, across fields ranging from construction and energy to healthcare and defense. Of those, 26 have more than 1,000 employees, and 6 are Fortune 500 companies. According to the researchers' estimate in their report, roughly 2% of the open apps contained material serious enough to rate as high or critical. The exposed material included a hospital group's searchable list of more than 3,500 employees, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet whose code held every employee's password in plain text. Grok can build a working app from a description typed into its chat, a feature its maker opened to every Grok plan on August 19. This chat builder shares the Grok Build name with a separate terminal coding tool, whose repository uploads were reported on July 14. Each published app gets its own subdomain of grok.me, and its creator chooses who can open it, according to the company's launch announcement. No app goes public until its creator clicks Publish. In the paid account the researchers used, the next step offered 3 access settings: "Anyone with the link", "Invited users" and "Only you". "Anyone with the link" was already selected. The setting matters because an app's address does not stay secret, the researchers say. Opening an app makes the visitor's computer look up its subdomain in DNS. Passive DNS services record such lookups, and anyone with an account can search those records by pattern. Grok suggests 4 random words as each app's name, and about half of the names the researchers found followed that pattern. Such names are hard to guess, but that does not protect an app whose name already sits in a searchable list. ChatGPT's app builder also puts each app on its own subdomain. But when the researchers shared an app there, its access was set to "Only me" until they changed it. A ChatGPT app address found in DNS data would lead to an app that only its owner can open, they say. The researchers found the Grok app names using common subdomain discovery methods and loaded each app's first page once, without signing in. To see what protection Grok adds on its own, the researchers built 2 test apps with made-up data and published both with the access setting already selected, "Anyone with the link". The first, a contact list, got a database but no sign-in. Without signing in, the researchers added a row from a private browser window, and the next visitor saw it. The second, a customer list for a 4-person sales team, got sign-in buttons that Grok added on its own: "Continue with Google" and "Continue with X". But the code Grok wrote added each person who signed in to the team before checking whether they belonged, so the check always passed. An uninvited Google account belonging to someone other than the owner got in, viewed every customer, edited one record, and deleted another. The researchers ran these tests only on their own apps. They did not test whether any of the open apps they found would accept such changes. The researchers reported their findings to SpaceXSI on Sunday through the address in its security.txt file, including 2 of the staff apps. They reported the other 22 on Monday. By the time the researchers published yesterday, the company had not replied to their report, but it had answered a reporter's questions about the research. As the researchers describe, the company said Grok apps stay private until their creator shares them. Publishing takes several steps, including choosing between "Only you" and "Anyone with the link," as well as a legal disclaimer. Employee accounts are set to "Only you" by default. Even so, 24 apps built by staff at the company and at X were open to anyone, the researchers say. With their report, the researchers had asked the company to make "Only you" the default and to add an option that limits an app to a company's own email domain. The company's response did not state that it would contact the owners of other open apps, according to the researchers. They have started emailing the affected organizations themselves and had emailed 3 by the time they published. They withheld every app address and title from the report. On October 18, the same researchers published Muse research showing that pages shared from Meta's Muse AI agent could be found through passive DNS. Meta disabled sharing, then announced a sharing fix on October 22 that gave shared items new addresses. How to Check Your Organization's Grok Apps Claroc, which sells tools to find and secure apps built with AI, recommends these checks: Find out which AI app builders your staff uses. Builders such as Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio can be used without IT setting them up or a company account. If you have access to passive DNS data, look up the builders' domains and open any results in a private browser window. Make sure any Grok app with internal data is set to "Invited users" or "Only you", and that a stranger gets an error page. Try to sign in with an account from outside your company. If it gets in, the app needs a list of who is allowed. Check the scripts each app loads for names, email addresses and passwords, and unpublish apps that have no owner. In the researchers' tests, setting an app to "Only you" caused it to return a 401 error to a stranger for both the page and its data, and unpublishing took an app offline within seconds. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Access Control, artificial intelligence, Cloud security, Data Exposure, data security, Web Security Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory The Flood is Coming And The Pipes Were Already Full Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Experts Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk