Over 35,000 Grok-built apps found with public access and leaked data

The scope of the exposure

Security researchers at Claroc identified a massive leak involving 37,571 apps created using the Grok chat builder. Of these, 35,578 were found to be completely open to the public without requiring any form of authentication or sign-in.

While many of these apps served simple functions like calculators or landing pages, the scale of the exposure is significant. About 1 in 10 of the discovered apps contained internal business or personal data, with roughly 2% of the total being rated as high or critical security risks.

The findings highlight a major gap in how AI tools handle privacy by default. As news.lavx.hu reported, the researchers found that quick prototypes intended for internal use were easily accessible to anyone who could find the specific web address.

Sensitive data revealed

The leak included highly sensitive information from various sectors, including healthcare, defense, and energy. One specific example involved a hospital group's searchable list of more than 3,500 employees, while another contained an intensive care briefing for a single patient.

Corporate secrets were also exposed, such as a confidential onboarding plan for a new sales hire and a sales territory map covering 594 accounts. Additionally, researchers found an X advertising proposal to a U.S. federal agency that was explicitly marked as confidential.

The exposure even included technical credentials and live operational data. One contractor's app stored every employee's password in plain text within the app's code, and a fire department's live shift board was also found to be publicly viewable.

How the apps became public

SpaceXSI opened the Grok chat builder to all users on August 19, allowing people to describe an app and receive a subdomain on grok.me. While users must click a 'Publish' button to go live, the system defaults to the most permissive sharing option: 'Anyone with the link.'

Even if a user does not share the link, the apps can still be discovered. When a visitor opens an app, their computer looks up the subdomain through DNS, and passive DNS services record these lookups. Subscribers to these services can then search for and find these addresses using common patterns.

The researchers noted a key difference between Grok and ChatGPT in this regard. While Grok defaults to public sharing, a shared ChatGPT app remains set to 'Only me' until the owner manually changes it, providing a layer of protection against discovery even if the address is found in DNS records.

Failed security controls

Claroc conducted tests to see if Grok's built-in security features actually worked. They found that the sign-in buttons Grok automatically adds to some apps were flawed. In one test, a customer list allowed an uninvited Google account to view, edit, and delete records because the code added every signer to the team before checking membership.

The company behind Grok, SpaceXSI, stated that apps stay private until shared and that employee accounts default to 'Only you.' However, the researchers found 24 apps from staff at X and SpaceXSI that were open to anyone despite these supposed protections.

In response to the findings, Claroc urged the company to change the default setting to 'Only you' and to add an option to limit access to specific company email domains. SpaceXSI has not yet committed to contacting the owners of the thousands of other exposed apps.

Steps for organizations

Organizations using AI builders should treat every prototype as a production asset that requires security oversight. Claroc recommends that teams inventory all AI builders in use, including tools like Grok, Lovable, Replit, and Google AI Studio, which can often be used without formal IT setup.

Security teams with access to passive DNS data should query builder domains to find exposed addresses. They should then verify access settings by attempting to reach the apps from a private browser window to see if they can view data without being prompted for a login.

Finally, developers should inspect the scripts loaded by their apps for embedded secrets like passwords or API keys. If an app is no longer needed or lacks a clear owner, it should be unpublished immediately, as this action can take an app offline within seconds.