94.7% of Grok-built web apps were open to anyone with the link

Almost 95 percent of the web apps built with the AI assistant Grok were publicly accessible without a login — and among the exposed data were patient records, plaintext passwords, and confidential sales documents from Grok's own maker.

That's the core finding of a new report by security firm Claroc, which examined 37,571 Grok-built apps that were still online and found that 35,578 of them, or 94.7 percent, anyone could open. Roughly two percent of the apps contained material the researchers classified as especially sensitive.

The story matters beyond one vendor: it's a concrete case study in what happens when AI code generators ship with insecure defaults, and it lands while regulators are already scrutinizing Grok's parent company over privacy design.

How did the apps get exposed?

In SpaceXSI's "Build" mode — the company was formerly known as xAI — users describe an app in a chat and Grok writes the code. An app gets its own address on grok.me only when its creator clicks "Publish."

Claroc blames the publish dialog itself. On the paid account the firm used for testing, "Anyone with the link" was already preselected. Discovery was trivial too: each app lives on its own subdomain, so its name shows up in commercial passive DNS databases after the first visit, and those databases can be searched by pattern.

In short, the default setting made apps public, and the addressing scheme made them findable.

What did SpaceXSI's own employees leak?

Twenty-four of the accessible apps came from SpaceXSI and X employees. Among them was a confidential onboarding plan for a new enterprise sales team member, which included internal system addresses and 19 chat channels.

Claroc also found:

• A publicly accessible sales territory map listing 594 strategic accounts and pipeline data
• Eight X ad proposals, one targeting a U.S. federal agency and marked confidential
• Campaign reports and dashboards showing ad spending

SpaceXSI has since taken those 24 employee apps offline, but it hasn't removed open apps belonging to other Grok users and organizations.

How bad was the third-party exposure?

Most of the open apps were games, landing pages, or calculators, Claroc says. But about one in ten contained sensitive material, internal business data, or personal information. The researchers estimate that 650 to 800 apps held private data.

Confirmed cases included an ICU briefing containing a patient's lab values, a list of more than 3,500 employees at a hospital group, and a fire department shift schedule. The source code of one timesheet app contained 18 accounts with plaintext passwords.

Beyond SpaceXSI and X, Claroc identified 30 affected organizations, six of them Fortune 500 companies. The firm is withholding their names.

Did the generated code have deeper flaws?

Yes. Two test apps Claroc built itself revealed problems beyond the sharing settings. A contact list app ended up with a database that had no login, so anonymous visitors could add entries. A sales team customer list was worse: Grok added Google and X sign-in on its own, but its code added every authenticated user to the team first and only checked membership afterward. An outside Google account could then read, edit, and delete records.

Claroc says it ran write and delete tests only on its own apps.

The settings to prevent this do exist. When the firm set its test app to "Only you," the app blocked outside access — it just isn't the default. For comparison, Claroc tested ChatGPT: a newly built app there defaulted to "Only me" when shared. That app's address can also surface in DNS data, but it leads to an app only the owner can open.

What did SpaceXSI say?

SpaceXSI responded to the disclosure only by saying that apps are private until their creator shares them, that publishing takes multiple steps including a legal notice, and that employee accounts default to "Only you."

Claroc counters that extra clicks don't help if "Anyone with the link" is still preselected at the final step. And the 24 open employee apps, the firm argues, show how little the stricter staff default actually helps in practice.

What fixes does Claroc want?

Claroc proposed that SpaceXSI make "Only you" the default and show who will have access before publishing. It also wants Grok to warn when an app has a database but no login, and to run apps on hard-to-guess paths on a shared host instead of individual subdomains, so app names don't end up in DNS databases.

Claroc offered to share its full list of exposed addresses confidentially. Because SpaceXSI didn't commit to contacting the affected app owners, Claroc is now notifying them directly. Worth noting: the firm sells security solutions for AI-built apps, so it has its own commercial stake here.

Is this part of a pattern?

It's at least the third privacy incident for SpaceXSI involving Grok. In August 2025, Forbes found more than 370,000 shared Grok conversations in Google Search. In July 2026, the terminal tool Grok Build uploaded user files to the company's servers without asking — including SSH keys and password databases. Separately, Ireland's data protection authority is investigating whether X neglected data protection by design because of sexualized deepfakes generated by Grok.

Other providers have similar sharing problems. Using the same passive DNS method, Claroc tracked down about 6,800 shared conversations from Meta's agent Muse in October. At Anthropic, shared Claude chats and artifacts, including user-built apps, turned up in search engines in July.

The takeaway in plain words: AI tools that build and publish apps in a few clicks need safe defaults, because most users will never change them — and the next default probably decides whether this happens again.