Over 35,000 Grok-built apps exposed online with sensitive data leaks

Security firm Claroc has identified a massive exposure of applications generated by the Grok AI assistant, revealing that over 35,000 of these apps were publicly accessible without authentication. The incident, reported on November 11, 2026, includes internal tools created by employees at X and SpaceXSI, leaking sensitive corporate data ranging from sales maps to employee passwords.

What happened

Claroc researchers scanned the internet for applications hosted on the grok.me subdomain, which is used for apps created via Grok’s chat-based builder. They discovered 37,571 such apps, of which 35,578 were open to anyone with the link and required no sign-in. While many of these were simple games or calculators, approximately 10 percent contained internal business or personal information. Among the exposed items were 24 apps built by staff at X and SpaceXSI, the company behind Grok. These included a confidential onboarding plan for a new sales hire, a sales territory map covering 594 accounts, and an advertising proposal marked confidential for a U.S. federal agency.

Beyond the tech companies directly involved, the researchers identified internal data from 30 other organizations across sectors like healthcare, defense, and energy. Six of these affected entities are Fortune 500 companies. The severity of the leaks varied, but Claroc estimated that about 2 percent of the open apps contained high or critical risks. Examples included a searchable list of 3,500 hospital employees, an intensive care patient briefing, and a contractor’s timesheet application that stored employee passwords in plain text within its code. SpaceXSI has since removed the 24 staff-created apps but has not taken down the broader set of user-generated applications.

The root of the issue lies in how Grok handles app publication. When users create an app via the chat interface, they must click "Publish" to make it live. During this process, the default access setting is "Anyone with the link," rather than a more restrictive option. Although Grok suggests random four-word names for apps, making them hard to guess, these names are not secret. Passive DNS services record every lookup of these subdomains, allowing attackers to discover app addresses by searching DNS logs. In contrast, researchers noted that ChatGPT’s app builder defaults to "Only me," meaning even if an address is found in DNS records, the content remains inaccessible to strangers.

Key details

• Scale of exposure: 35,578 out of 37,571 discovered Grok-built apps were publicly accessible without login requirements.
• Corporate impact: 24 apps from X and SpaceXSI staff were exposed, along with data from 30 other organizations, including six Fortune 500 companies.
• Sensitive data types: Leaks included sales territory maps, confidential government proposals, patient medical briefings, and plain-text passwords.
• Default settings risk: The "Anyone with the link" permission was pre-selected during publication, unlike competitors who default to private access.
• Discovery method: Researchers used passive DNS data to find app subdomains, proving that obscure names do not guarantee security.
• Vendor response: SpaceXSI removed staff apps but did not commit to contacting other affected users or changing default permissions.

Background

Grok Build allows users to generate functional web applications by describing them in a chat interface. This feature was made available to all Grok plans on August 19, 2026. Each published app receives a unique subdomain under grok.me. The security model relies on the creator manually selecting access controls: "Anyone with the link," "Invited users," or "Only you." However, the convenience of AI generation often leads to "shadow IT," where employees build and deploy tools without oversight from central IT or security teams.

Passive DNS monitoring is a common technique used by both security researchers and attackers. Every time a device resolves a domain name to an IP address, that query can be logged by third-party services. By aggregating these logs, one can reconstruct a list of active subdomains for a given parent domain. This means that even if an app name is random and unguessable, it becomes discoverable as soon as someone visits it, rendering "security by obscurity" ineffective.

Why it matters

For IT leaders and engineering managers, this incident highlights the risks of unmanaged AI tooling. When developers or business units use AI builders outside of sanctioned platforms, they bypass standard security reviews, access controls, and data loss prevention policies. The fact that Grok-generated code sometimes fails to properly validate user identity—such as adding any signed-in Google user to a team without checking affiliation—demonstrates that AI-generated code cannot be trusted to be secure by default. Teams must assume that any app built this way may have critical vulnerabilities unless explicitly tested.

The exposure of plain-text passwords and confidential HR documents underscores the need for strict data governance. Even if an app seems harmless, like a calculator or landing page, it may connect to internal databases or contain hardcoded secrets. The ease of deployment means that sensitive data can leak rapidly and remain exposed for long periods if not actively monitored. Organizations can no longer rely solely on perimeter defenses; they must account for data flowing through ephemeral, user-created applications hosted on external platforms.

What you can do

• Audit AI tool usage: Identify which AI app builders (such as Grok, Lovable, or Replit) your staff is using and establish clear policies for their use.
• Check DNS exposure: If you have access to passive DNS data, search for subdomains associated with known AI builders to find potentially exposed internal apps.
• Verify access controls: For any existing Grok apps containing internal data, ensure the setting is changed to "Invited users" or "Only you" and confirm that strangers receive an error page.
• Test authentication logic: Attempt to sign in to internal apps using an external account to verify that the app correctly restricts access to authorized personnel only.
• Scan for secrets: Review the source code or loaded scripts of AI-generated apps for hardcoded passwords, API keys, or email addresses, and unpublish any app that lacks a clear owner.
• Enforce default privacy: Advocate for vendors to change default publishing settings to "Private" or "Only me" to reduce accidental exposure.