35,578 Apps Open to Anyone. Grok Built Them All.

Security researchers found 37,571 Grok-built apps on the public internet — 35,578 of them open to anyone, no sign-in required. The apps were built by users typing descriptions into Grok’s chat builder, and the data inside ranged from games and calculators to a hospital’s employee list, an intensive care briefing, and a timesheet with every employee’s password in plain text.

The finding comes from Claroc, which studies apps built with AI. They reported it to SpaceXSI — the company behind Grok, formerly xAI — on Sunday and Monday. The 24 staff apps have since been taken down. The other users’ apps, as far as anyone knows, are still open.

What Claroc found

Most of the open apps were harmless: games, landing pages, calculators. But about 1 in 10 contained internal business or personal data, and roughly 2% held material serious enough to rate as high or critical.

The staff apps are the sharpest part. Twenty-four were built by people at X and SpaceXSI, and they included a confidential onboarding plan for a new sales hire, a sales territory map covering 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential. Employee accounts supposedly default to private — yet those 24 apps were open to anyone.

Internal data from 30 other organizations was also exposed, spanning construction, energy, healthcare, and defense. Twenty-six have more than 1,000 employees, and six are Fortune 500. Exposed material included a hospital group’s searchable list of more than 3,500 employees, an intensive care briefing on a single patient, and a fire department’s live shift board.

Why the apps were open

The exposure was not a hack — it was a chain of defaults.

Grok’s chat builder, opened to every Grok plan on August 19, turns a typed description into a working app on its own grok.me subdomain. The creator chooses who can open it — but in the paid account the researchers used, “Anyone with the link” was already selected.

That setting matters because an app’s address does not stay secret. Opening an app makes the visitor’s computer look up its subdomain in DNS, and passive DNS services record those lookups for anyone with an account to search by pattern. Grok suggests four random words as each app’s name — hard to guess, but no protection once the name sits in a searchable list.

The researchers tested Grok’s protections with two test apps built from made-up data. A contact list got a database but no sign-in — a row added from a private browser window was visible to the next visitor. A customer list for a four-person sales team got sign-in buttons, but the code added each signer to the team before checking whether they belonged, so the check always passed. An uninvited Google account got in, viewed every customer, edited one record, and deleted another.

What SpaceXSI said — and did not say

The company had not replied to the report by publication time, though it answered a reporter’s questions. The company said Grok apps stay private until their creator shares them, and that publishing takes several steps, including choosing between “Only you” and “Anyone with the link”. Employee accounts, it said, default to “Only you”. Even so, 24 staff apps were open to anyone.

With their report, the researchers asked the company to make “Only you” the default and to add an option limiting an app to a company’s own email domain. The company did not say it would contact the other apps’ owners — the researchers have started emailing the affected organizations themselves and had reached three by publication.

What to do

Find out which AI app builders your staff uses. Builders such as Grok, Lovable, Replit, v0, Bolt, Base44, and Google AI Studio need no IT setup or company account — that is shadow AI, and why nobody in IT knew these apps existed.

Audit any Grok app holding internal data. With passive DNS data, look up the builders’ domains and open any results in a private browser window. Set any Grok app with internal data to “Invited users” or “Only you”, and confirm a stranger gets an error page.

Test the sign-in with an account from outside your company. If it gets in, the app needs a real allow-list — Grok’s own test showed a sign-in button is not an access check. Setting an app to “Only you” returned a 401 to strangers in their tests, and unpublishing took an app offline within seconds. Check the scripts each app loads for names, email addresses, and passwords — and unpublish apps that have no owner. A password baked into an app’s code is a password published to the internet.

AI app builders are not the danger. A tool built to remove friction also removes the friction that used to protect you — the IT ticket, the access review, the person who asked “who should see this?” When the answer defaults to “anyone with the link” and the link is findable, the app is public. The same pattern — credentials leaking through trusted tools — showed up in the LLMjacking wave, where stolen AI keys ran up million-dollar bills, and in Claude Code’s “Don’t Ask Again” file, which left passwords and keys in public repos. Check your Grok apps before someone else does.