Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday.
Claroc's sweep: scale, method, and immediate findings
Claroc, which sells tools to find and secure apps built with AI, used standard subdomain-discovery techniques and passive DNS lookups to locate Grok-built apps and then loaded each app's first page once without signing in. The company reported finding 37,571 Grok-built apps overall and says 35,578 of those were accessible without any sign-in. About half of the app names matched Grok’s recommended pattern of four random words.
Claroc noted most open apps were simple items — games, landing pages, calculators — but roughly one in ten contained internal business or personal data. The researchers estimate roughly 2% of the open apps contained material serious enough to rate as high or critical.
Concrete exposures: staff apps and sensitive records
Among the open apps were 24 created by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant (SpaceXSI was formerly known as xAI). Claroc says SpaceXSI has since taken down all 24 staff apps but did not take action on other users’ apps.
Claroc provided examples of exposed, sensitive content found in the dataset: a hospital group's searchable list of more than 3,500 employees; an intensive-care briefing on a single patient; a fire department’s live shift board; and a contractor timesheet whose code contained every employee’s password in plain text. The staff apps included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow Grok’s publishing flow and DNS visibility intersect
Grok’s chat builder can produce working apps from descriptions typed into chat; that feature was opened to every Grok plan on August 19. Each published Grok app receives its own subdomain of grok.me and — per the company's launch announcement — its creator chooses who can open it. Claroc’s tests of a paid Grok account showed the publishing workflow offered three access settings: “Anyone with the link”, “Invited users”, and “Only you”, and that “Anyone with the link” was already selected when publishing.
Claroc stresses the significance of that choice because an app’s subdomain is discoverable via DNS: opening an app triggers a DNS lookup, and passive DNS services record those lookups. Anyone with access to passive DNS data can search patterns and enumerate subdomains. That visibility, the researchers show, defeats the secrecy of a guessed address once it has appeared in DNS records.
Tests of app protections: plausible impersonation and write access
To evaluate default protections, Claroc published two test apps with made-up data and left the access setting at “Anyone with the link.” The first, a contact list, received a backend database but no sign-in flow; the researchers added a row from a private browser window and the change was visible to the next visitor. The second, a four-person customer list, was rendered with sign-in buttons Grok added itself — “Continue with Google” and “Continue with X”. However, the generated code added any account that completed sign-in to the team before verifying membership, so an uninvited Google account was able to view every customer, edit a record, and delete another.
Claroc emphasizes they ran those actions only on their own test apps and did not try the same edits on the open apps they discovered.
What SpaceXSI and affected organizations have done — and what Claroc recommends
Claroc reported its findings to SpaceXSI via the address in the company's security.txt file: the researchers say they reported two staff apps on Sunday and the other 22 on Monday. By the time Claroc published its research, SpaceXSI had not replied to the report but had answered a reporter’s questions about the research. The company told the reporter that Grok apps “stay private until their creator shares them,” that publishing involves choosing between “Only you” and “Anyone with the link” plus a legal disclaimer, and that employee accounts are set to “Only you” by default.
Claroc asked SpaceXSI to change defaults so “Only you” is selected at publish time and to add an option to limit an app to a company’s own email domain. The company’s response, according to Claroc, did not state it would contact the owners of other open apps. Claroc began emailing affected organizations itself and had notified three by the time it published its report; Claroc withheld all app addresses and titles from its public write-up.
Claroc also published a recommended checklist for organizations, including: inventory which AI app builders staff are using (Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio were named); if you have passive DNS access, look up builders’ domains and open results in a private window; set internal Grok apps to “Invited users” or “Only you” and verify a stranger receives an error page; attempt sign-in with an external account to confirm membership checks; and inspect loaded scripts for names, email addresses and passwords, unpublishing apps that have no owner. In their tests, switching an app to “Only you” returned a 401 error for strangers and unpublishing took an app offline within seconds.
Claroc’s work is the latest public demonstration that AI builders’ convenience features and DNS visibility can combine to expose internal information at scale. SpaceXSI removed staff-created apps flagged by the researchers, but the company has not—according to Claroc—committed to contacting other exposed app owners, leaving organizations and security teams to decide whether to use passive DNS, follow Claroc’s checklist, or await further action from the platform.
https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html
