A setting in Grok’s app publishing flow had broad consequences: Claroc found that 35,578 of 37,571 apps it checked were accessible to anyone with the link. Among the exposed material were patient lab values, plaintext passwords, and confidential business information from SpaceXSI and X.
When publishing means access by link
Grok’s Build mode lets users describe an app in a chat, after which Grok writes the code. The app becomes public when its creator selects “Publish,” which gives it an address on grok.me. In the paid account Claroc used for testing, the publishing dialog already had “Anyone with the link” selected.
Claroc counted 94.7 percent of the 37,571 apps that remained online as open without login. The addresses were also discoverable: each app had its own subdomain, and its name could appear in commercial passive DNS databases after the first visit. Those databases can be searched using patterns.
Most open apps were games, landing pages, or calculators, according to Claroc. But the firm estimated that 650 to 800 apps contained private data. About one in ten open apps held sensitive material, internal business data, or personal information; roughly two percent were classified as especially serious.
Business records and personal data surfaced
Claroc identified 24 accessible apps made by SpaceXSI and X employees. They included an onboarding plan for a new enterprise sales team member, with internal system addresses and 19 chat channels. Other exposed items included a territory map listing 594 strategic accounts and pipeline data, eight X ad proposals, and campaign reports and spending dashboards.
One of the ad proposals targeted a U.S. federal agency and was marked confidential. The exposure was not limited to company materials. Claroc confirmed an ICU briefing containing a patient’s lab values, a hospital group employee list with more than 3,500 people, and a fire department shift schedule.
In another case, the source code of a timesheet app contained 18 accounts with plaintext passwords. Claroc said it found 30 affected organizations beyond SpaceXSI and X, including six Fortune 500 companies. It is withholding those organizations’ names.
App code could create access problems too
Claroc’s tests also found weaknesses inside apps it built itself. A contact list app used a database without login, allowing anonymous visitors to add entries. In a customer-list app, Grok added Google and X sign-in, but the generated code added every authenticated user to the team before checking membership.
As a result, an outside Google account could read, edit, and delete records in that test app. Claroc said it performed write and delete tests only on its own apps. The examples show that adding a sign-in option does not by itself guarantee that access is limited to the intended team.
Grok has an “Only you” setting that blocked outside access in Claroc’s test. The problem, the firm said, was that this safer choice was not the default. In a separate test with ChatGPT, a newly built app defaulted to “Only me” when shared. Its address could still appear in DNS data, but only its owner could open the app.
Defaults, visibility, and follow-up
SpaceXSI said apps remain private until their creator shares them, publishing involves several steps and a legal notice, and employee accounts default to “Only you.” Claroc argued that these safeguards do not address the final publishing screen if “Anyone with the link” is preselected. The 24 accessible employee apps, it said, also show the limits of the employee-account default.
Claroc recommended making “Only you” the default and clearly showing who can access an app before publication. It also proposed warnings when an app has a database but no login, and replacing individual subdomains with hard-to-guess paths on a shared host. That would make app names less visible in DNS data.
SpaceXSI has taken the 24 employee apps offline, but the source says other open apps from Grok users and organizations have not been removed. Claroc offered to provide SpaceXSI with the full address list confidentially. After SpaceXSI did not commit to contacting affected owners, Claroc began notifying them directly. The firm sells security solutions for AI-built apps, a commercial interest relevant to its role in reporting the findings.
The article describes this as at least the third privacy incident involving SpaceXSI and Grok. It also notes comparable sharing exposures involving Meta’s agent Muse and Anthropic’s Claude chats and artifacts. The recurring issue is how easily shared material can become discoverable, and whether the access controls around AI-built tools make that visibility clear before users publish.