35,578 Grok-Built Apps Opened for Anyone, Including 24 Built by Staff of xAI (Now SpaceXSI) and X. Most Were Games. Here Is How Claroc Counted, and How to Check Your Own
If anyone in your company has published an app from Grok, open it in a private browser window while signed out. If it loads, anyone who finds its address can see it too. Switch it to "Only you" or "Invited users" in Grok, or unpublish it, and check the app's script files for names, emails and passwords. Then ask the same question about every other AI app builder your staff can use without IT, such as Lovable, Replit, v0, Bolt, Base44, Google AI Studio and ChatGPT's published apps.
What the research found
The primary source is Claroc Research, "GhostShares 2: Grok Apps Exposed xAI's Business Secrets and People's Private Data," by Asaf Aprozper, published November 10, 2026. We read it in full. The Hacker News covered it on November 11. Claroc sells tools that find and secure AI-built apps, so it has a commercial interest in the finding; the method is described well enough to judge on its own.
When Grok publishes an app it gets its own address under grok.me. In the paid account Claroc used, the publish panel offered three access settings and "Anyone with the link" was already selected.
35,578 apps opened with no sign-in. Most were games, landing pages and calculators.
24 of the open apps were built by staff of SpaceXSI (the company formerly called xAI) and X, including a confidential onboarding plan for a new sales hire, a map of 594 sales accounts and an advertising proposal to a US federal agency marked confidential. SpaceXSI took those 24 down after Claroc's report.
Besides SpaceXSI and X, 30 organizations that Claroc could identify had internal data in open apps: 26 with more than 1,000 employees, 6 in the Fortune 500, 18 based in the US. Sectors include construction, energy, healthcare and defense. Claroc names none of them.
Examples Claroc confirmed by hand: a hospital group's searchable roster of more than 3,500 staff, an intensive-care briefing on one patient, a fire department's live shift board, and a contractor's timesheet app whose script, downloaded by every visitor, held 18 accounts with passwords in plain text.
How the 35,000 was counted
This is the part headlines skip, and it matters, because "exposed" here means something narrow.
Finding the names. Claroc used common subdomain-discovery techniques and listed 43,601 names under grok.me. (The report's summary says it "tried 43,551" addresses; the two figures differ by 50 and Claroc does not explain the gap.) Nobody sent Claroc any of these links.
Why the names are findable. Each app's address is a host name. The first time anyone opens it, their computer looks the name up in DNS, and passive DNS services record those lookups and let subscribers search them by pattern. Grok suggests four random words as the name, and about half the names Claroc saw were exactly that, but random names do not help once the name is in a searchable database.
Testing access. Claroc loaded the first page of each app once, on November 8, from the public internet, signed in to nothing. 37,571 were still online. Of those, 35,578 (94.7%) loaded without asking for a sign-in, and 1,993 (5.3%) answered with an access-denied error (HTTP 401), which is what an app set to "Only you" or "Invited users" returns.
Finding the sensitive ones. An AI model flagged pages that looked private, Claroc read the flagged ones by hand, and checked the model against a random sample. Its estimate is roughly 650 to 800 apps with private data. Elsewhere the report says about 1 in 10 open apps held sensitive business or personal material and roughly 2% held material Claroc rates high or critical. Those three figures use different definitions and Claroc does not reconcile them; we read the 650 to 800 as its most careful number.
So the 35,578 counts apps whose first page opened for a stranger, not 35,578 leaks. The confirmed serious exposures are in the hundreds.
Claroc did not sign in to, write to or test anyone else's apps. It built two apps of its own: a contact list with a database and no sign-in, to which a stranger could add rows, and a team customer list where Grok's sign-in code added any signed-in Google account to the team before checking membership, so an uninvited account could read, edit and delete records. Claroc proved that only on its own apps, and says the open apps it found may be worse than they look for that reason.
What SpaceXSI says
Per Claroc and The Hacker News, SpaceXSI said Grok apps are private until their creator shares one, that publishing takes several steps including choosing access and accepting a legal disclaimer, and that employee accounts default to "Only you." It took down its staff's 24 apps but, as of publication, had not said it would contact the owners of the other open apps. Claroc began emailing affected organizations itself and had reached three by publication.
What to do
Find what your staff have built. Ask, and if you have passive DNS data, search it for the builder domains (grok.me and the others above) and open what you find in a private window. Do not open or test other organizations' apps.
Check the access setting of every Grok app holding anything internal. A stranger in a private window should get an error page.
Test sign-in from outside. Sign in with an account that is not on your team. If it gets in, the app checks who you are but not whether you belong, and needs an explicit list of allowed users.
Read the scripts the app loads. Anything in them, names, emails, passwords, keys, is downloaded by every visitor. Move secrets out and change any password that was there.
Unpublish apps nobody owns. Claroc reports unpublishing takes a grok.me app offline within seconds.
Write the rule down: no patient, staff, customer or credential data in an app that has not passed the checks above.
What is not known
Which organizations are affected (Claroc withholds them, rightly), whether anyone else has already harvested these apps, and whether SpaceXSI will change the default or notify owners. We did not repeat Claroc's scan.
How we know, and how we checked
We read Claroc's report and The Hacker News article. We did not look for, open or test any Grok app, and we publish no app address, name or leaked value. The open apps are victims, not threats, so we add nothing to our feed: there are no attacker indicators in this story.
Sources
Claroc Research, "GhostShares 2: Grok Apps Exposed xAI's Business Secrets and People's Private Data," Asaf Aprozper, November 10, 2026 (blog.claroc.io). The Hacker News, "Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords," November 11, 2026.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Comments