Researchers find 35,000 Grok-built apps open to strangers, including company secrets

More than 35,000 apps created with Grok Build could be opened without a login, exposing data that included confidential business records and medical information, security firm Claroc found. The exposure reached the platform’s own maker: SpaceXSI removed 24 affected employee apps after Ars Technica asked questions, while other users’ data remained accessible.

Claroc counted 35,578 apps accessible without login among 37,571 still-online apps it checked, according to The Decoder’s November 11 account. That is 94.7 percent of the checked apps, not a measure of how many held confidential records. Most open apps were games, landing pages or calculators, the firm said.

A secret link that DNS could reveal

Link sharing was part of Build Mode’s original pitch. In its July 28 announcement, the company described turning a chat request into a working app, then publishing it to a link anyone could open. It promoted internal utilities and business dashboards alongside websites and games, with publication to a grok.me address or a custom domain.

The address design undermined the secrecy of those links, Claroc found. Grok Build put randomized words in each app’s subdomain—the portion before grok.me. Those names could appear in passive DNS services, searchable databases of domain lookups. Someone could therefore find app addresses through a database search rather than guessing the random words or receiving a link from its creator.

Ars contrasted that design with shared links that put the secret string in the path, after the domain. DNS does not see that portion. Claude’s published artifacts, ChatGPT’s shared conversations and Gemini’s shared links use that arrangement, keeping the secret part out of passive DNS searches.

Private until published—but published to whom?

SpaceXSI and Claroc describe different stages of the same workflow. The company emphasizes that creators must choose to publish. The researchers focus on who gains access after that choice. Their test used a paid account, where the publishing dialog already had “Anyone with the link” selected.

Restrictive settings did work in Claroc’s tests: “Only you” blocked outside access. But a separate test showed why adding a sign-in screen alone was insufficient. In a sales-team app, Grok-generated code added every authenticated visitor to the team before checking membership. An outside Google account could then read, edit and delete records.

Another test app had a database without a login, allowing anonymous visitors to add entries. Claroc said it performed write and delete tests only on its own apps; those demonstrations should not be read as proof that outsiders could alter every exposed project.

The maker’s records came down first

The sensitive material Claroc found went well beyond app demonstrations. Its examples included records about workers’ health, employment and compensation:

• A Peruvian construction company’s occupational-health dashboard contained 3,784 worker medical exams.
• A Tesla service-center scorecard named 22 technicians and showed their productivity and bonus status.
• A healthcare company’s hospital staff app listed about 3,565 employees by name and ID.

SpaceXSI’s own exposed material included a confidential onboarding plan for an enterprise sales employee, internal tool addresses and advertising proposals. A sales territory map covered 594 accounts. Claroc identified 24 affected company apps, putting the platform maker’s internal business information behind the same discoverable sharing mechanism.

Ars said SpaceXSI began removing those links within hours of receiving its questions. By the article’s November 10 publication, all 24 returned an “app not found” error, while almost all other exposed data remained available. The takedowns addressed the company’s own records, not the wider exposure Claroc had identified.

Claroc co-founder and chief technology officer Asaf Aprozper said he was notifying affected organizations. One luxury cruise company brought in its security team after learning of the findings and was working to contain the exposure. Claroc itself sells security products for AI-built apps, a commercial interest alongside its disclosure.