35,578 Grok Apps Open Without Sign-In, Claroc Finds

Nearly 95 percent of live Grok apps — 35,578 out of 37,571 — opened without any sign-in when cybersecurity firm Claroc tested them, exposing confidential corporate, employee and personal material to anyone with the URL. Claroc's findings, reported November 10, 2026, include 24 apps built by staff at SpaceXSI, the company formerly known as xAI, and X.

The research, conducted under the name GhostShares, shows how a convenient app-building feature becomes a data-leak surface at scale. Users create apps by describing them in a chat window and publish them from the same window, using Grok's Build mode. Each published app then receives its own hostname of the form

How Did Claroc Find the Apps?

Claroc identified 43,601 names under grok.me using common subdomain-discovery techniques. The method exploits the Domain Name System (DNS), the internet's hostname directory: resolving an app's

Researchers loaded each app's first page once from the public internet without signing in, then reviewed saved copies offline. Of the 43,601 discovered names, 37,571 apps were still online. The remaining 1,993 returned HTTP 401 access errors, which correspond to the "Only you" or "Invited users" settings — evidence that the access controls work when they are enabled.

What Did the Open Apps Contain?

The staff-built apps carried some of the most sensitive material in the dataset:

• A confidential enterprise-sales onboarding plan
• A territory map covering 594 strategic accounts and their sales pipeline
• Eight X advertising proposals, media plans and decks, one of them addressed to a US federal agency and marked confidential
• A separate advertiser account board tracking progress toward a $1.6 million sales goal

Beyond SpaceXSI and X, Claroc identified internal data from 30 organizations. Twenty-six of them had more than 1,000 employees, and six were Fortune 500 companies. Most of the open apps were benign — games, landing pages and calculators. But Claroc estimated that between 650 and 800 apps contained private data, after using an AI model to flag candidates, manually reviewing flagged pages, and validating the model against a random sample.

The manually confirmed cases were severe:

• A hospital group's searchable roster of more than 3,500 employees
• An intensive-care briefing containing one patient's labs, imaging results and ventilator status
• A fire department's live shift board listing firefighters' names and badge numbers
• A contractor's timesheet that exposed 18 employee account records with plaintext passwords, including administrator accounts, in script code downloaded by every visitor's browser

What Happens When an App Accepts Writes?

Claroc built two apps with fabricated data to test write access and authorization, the mechanism that should limit who can change records.

In its paid account, nothing became public before the builder clicked Publish. But the access panel that appeared afterward preselected "Anyone with the link," alongside "Invited users" and "Only you."

The first test app was a contact list with a database and no sign-in requirement. A record added from a signed-out incognito window was visible to the next visitor. The second app, a customer list intended for a four-person sales team, fared worse. Grok's generated code added Google and X sign-in buttons, but it enrolled whoever signed in as a team member before checking membership — so the check always passed. An uninvited Google account viewed every customer, changed one record and deleted another.

Those tests separate two failure modes: public readability on one hand, and broken write protection on the other. An open app may allow data changes if it lacks sign-in entirely, or if it verifies identity without verifying team membership. Claroc demonstrated the write and authorization failures only in its own apps. It did not sign in to, submit forms to, call server functions on, or modify anyone else's app.

The controls themselves held up when properly set. With "Only you" selected, the first test app returned HTTP 401 to a stranger for both its page and its data function. Unpublishing the second app took its address offline within seconds.

How Did SpaceXSI Respond?

Claroc notified SpaceXSI on November 8, 2026, about the onboarding plan and one advertising proposal, providing exposure counts, the two test apps and four proposed fixes. It reported the other staff apps on November 9, 2026.

At publication, SpaceXSI had answered a reporter's questions but had not replied directly to the research report. The staff apps came down following the report. Other users' exposed apps remained online.

SpaceXSI told the reporter that apps remain private until creators choose to share them, that publishing requires several steps, and that employee accounts default to "Only you." Claroc's finding concerns a different layer: the access choice in an ordinary paid account, where "Anyone with the link" was preselected. The staff apps were nevertheless publicly accessible despite the described employee default.

Claroc's four proposed fixes were:

• Put shared apps on hard-to-guess paths under a single host, removing enumerable per-app hostnames
• Add organization-domain-restricted sharing
• Default to "Only you" while showing who can open an app before publication
• Add warnings for database-backed apps without sign-in, with automatic invite-list generation when a request describes a team

What Is the Broader Significance?

Because SpaceXSI's response did not say the company would notify app owners, Claroc began contacting affected organizations itself. Three had been emailed by publication time. The public report omitted hostnames, app titles and links, and Claroc said it will delete its saved copies once notifications are complete.

The findings widen the security concern beyond simple URL secrecy. Discoverable hostnames made published apps enumerable at scale — 43,601 of them — and the controlled tests showed that generated sign-in code can fail to enforce team membership even after a visitor authenticates. As AI chat platforms add one-window build-and-publish features, default access settings are likely to determine whether the next dataset leak involves 594 sales accounts or a hospital's intensive-care records.