Most of the published Grok apps that the security firm Claroc could find opened for anyone who reached their web address, with no sign-in, Claroc said in a report on Nov. 10. Grok is the AI assistant from SpaceXSI, the company formerly called xAI. Of the 37,571 Grok apps that were still online when Claroc checked, 35,578, or 94.7%, opened. Claroc sells tools that secure apps people build with AI, so it sells fixes for the kind of problem it reports.
In Grok, people describe an app in the chat, Grok writes it, and they publish it from the same window. SpaceXSI said in August that each published app gets its own address on grok.me and that the maker decides who can open it: just them, anyone with the link, or the whole internet. In the paid account Claroc used, the publish step offered "Anyone with the link", "Invited users" and "Only you", with "Anyone with the link" already selected. About half the addresses Claroc saw were four random words that Grok suggested, which nobody would guess. But each time someone opens one, their computer asks the internet's address directory where that name lives. Commercial services collect many of those requests in records that anyone with an account can search. One search of those records lists the app addresses. Shared chats on ChatGPT and Gemini, and pages published from Claude, keep the secret part of the link after the site's name, where the directory never sees it, though Claroc notes such links can still leak through search engines.
Most of the open apps were games, simple web pages and calculators. Claroc says about 1 in 10 of the open apps held internal business or personal material, and estimates that roughly 650 to 800 held private data. Among those it confirmed by hand were a hospital group's searchable roster of more than 3,500 employees and an intensive care briefing on one patient, with lab results, scans and breathing machine status. Others were a fire department's live shift board with firefighters' names and badge numbers, and a contractor's timesheet. The timesheet's code, which every visitor's browser downloads, held 18 staff accounts with their passwords unscrambled. Besides SpaceXSI and X, open apps held internal data from 30 organizations Claroc could identify, six of them Fortune 500 companies. Claroc's report names none of them.
Twenty-four of the open apps were built by SpaceXSI and X staff. They included a confidential onboarding plan for a new member of SpaceXSI's enterprise sales team, a sales territory map of 594 accounts and eight X advertising proposals and plans, one of them to a U.S. federal agency and marked confidential. Claroc says it reported the problem to SpaceXSI on Nov. 8 and 9, and that SpaceXSI took down its staff's 24 apps after the report but not the apps of other Grok users.
Claroc also built two test apps of its own with made-up data. For the first, Claroc asked for a contact list every visitor could see. Grok gave it a database with no sign-in, and a visitor who was not signed in could add to it. For the other, a customer list for a four-person sales team, Grok added sign-in with Google and X on its own. But the code Grok wrote added whoever signed in to the team before checking whether they belonged there. A stranger's Google account could then read, change and delete records. Claroc tried this only on its own apps, so it is not known how many of the open apps also let strangers change their data.
SpaceXSI told a reporter covering the research that Grok apps are private until their maker chooses to share one, that publishing takes several steps, and that its own staff's apps start out set to "Only you". Claroc agrees nothing goes public until the maker clicks Publish, but says the access step that follows came set to "Anyone with the link". Claroc asked SpaceXSI to make "Only you" the default for everyone. It says SpaceXSI defended the current setting rather than saying it would change it, and as of Nov. 10 had not said it would contact the owners of the other open apps. Claroc says it has begun emailing affected organizations itself, and had emailed three when it published its report on Nov. 10.
Claroc says other AI app builders, including ChatGPT, Lovable and Replit, also give each app its own address, so their addresses can turn up in the same records. Unlike Grok, when Claroc shared an app ChatGPT built, only the owner could open it until Claroc changed the setting.