Thousands of Grok Build apps exposed their pages to the open web, according to a Nov. 10 report from security firm Claroc. Of 37,571 live apps it checked, 35,578 opened without any sign-in. If you’ve published anything with Grok’s app builder, check its sharing setting today.
Here’s the short version before the details:
- Who found it: Claroc, a security firm, published its findings on Nov. 10, 2026.
- Scale: 35,578 of 37,571 live apps (94.7%) loaded without a login.
- Likely cause: Claroc says the publish screen preselected “Anyone with the link.”
- Vendor view: SpaceXSI says apps stay private until shared and employee accounts default to “Only you.”
- Your move: switch sharing to “Only you” or “Invited users,” then test from a logged-out window.
Most of those apps were harmless games and calculators. A small slice was not, and that slice is the reason to act.
What Claroc found inside the open apps
Claroc says most of the open apps were ordinary: games, landing pages and calculators. It estimates that 650 to 800 held private data, though that figure is the firm’s own estimate rather than a verified count.
The examples are the uncomfortable part. According to The Deep Dive, one app held medical exam results for 3,784 workers at a Peruvian construction firm, and another listed a 108-person staff roster tied to a Navy logistics contract. Tbreak adds a timesheet app whose source code contained 18 accounts with plaintext passwords.
Claroc also counted 30 organizations with internal data in open apps, six of them Fortune 500 companies. It hasn’t named them, so treat that as the firm’s claim for now.
How strangers found apps with random-looking addresses
Each published app gets its own grok.me address with a few random words in it. The idea is that nobody can guess the link.
Claroc’s analysis says that idea doesn’t hold up. Passive DNS services log lookups for new addresses, and commercial customers can search those logs. Using that route, the firm listed 43,601 grok.me addresses without guessing anything.
The takeaway is simple: a hard-to-guess link is not a lock. If an app is set to open for anyone with the link, assume someone can find the link.
Why the Grok Build apps exposed so much data
Claroc says the publish step in its paid test account had “Anyone with the link” preselected. Apps weren’t made public automatically, since creators still had to publish. But a default that points at the open option means many people never changed it.
Here’s how the three sharing choices compare, based on Claroc’s tests as reported:
| Sharing setting | Who can open it | What Claroc reported |
|---|---|---|
| Anyone with the link | Anyone who has or finds the address | Preselected in its test account; the setting behind most open apps |
| Invited users | People you add | Faulty team-access checks in a test app let an uninvited Google account read, edit and delete records |
| Only you | Just the owner | Outsiders got an error page |
Claroc tested only apps it built itself, so it can’t say whether any exposed app let strangers change real data. Coverage so far doesn’t explain the team-access flaw in detail or say whether it’s fixed.
What SpaceXSI says, and what’s still unclear
SpaceXSI, the company formerly known as xAI, told a reporter that apps stay private until shared, that publishing takes several steps, and that employee accounts default to “Only you.” Claroc disputes the point. Extra steps don’t help, it argues, when the access setting already says everyone.
Per The Deep Dive, SpaceXSI began pulling 24 of its own staff apps within hours of reporters asking, while almost all other apps stayed online. I couldn’t confirm any change to the default setting, so don’t assume one.
It isn’t the first Grok Build trust problem. In July, Cybernews reported that the terminal version uploaded whole git repositories, secrets included. That was a different issue, but the two together are a reason to be cautious about what you put in the tool.
How to check your own AI-built apps in five minutes
This applies to any AI app builder, not just Grok. Work through these in order:
- Open the app’s sharing settings and change “Anyone with the link” to “Only you” or “Invited users.”
- Open the app’s link in a private browser window while logged out. You should see an error or a login prompt.
- Remove real names, medical details, customer lists and any passwords or API keys from the app and its source.
- Rotate anything sensitive that lived inside the app, because you can’t know who opened it.
Step four is the one people skip, and it’s the one that limits the damage. Our guide to rotating AI keys after a breach covers the order to do it in, and our post on checking a settings file for leaked passwords shows where secrets tend to hide.
Frequently Asked Questions
Were Grok Build apps hacked?
Not in the usual sense, based on the reports. Claroc describes apps that were reachable because of how they were shared, and it tested only its own apps.
Does this affect ChatGPT or other app builders?
Claroc says ChatGPT’s builder kept new apps on “Only me” until the setting was changed, according to The Deep Dive. For any other builder, check the default yourself rather than trusting it.
Can I tell if someone opened my app?
The reports don’t mention a viewer log for Grok Build apps. If the app was set to “Anyone with the link,” assume it may have been opened.
Has the default been fixed?
That isn’t confirmed. SpaceXSI disputes that the default was open, and the articles I read don’t report a change.
The bottom line for builders
I’d treat every published AI app as public until I’ve proven otherwise from a logged-out window. The builder’s default is a convenience, not a security decision, and Claroc’s numbers show how many people trusted it anyway. If an app ever held real customer, patient or employee data, lock it down now and rotate what was inside before you go back to building.
Leave a Reply