Grok Build apps: 94.7% open to anyone, including patient data

A security firm spent a weekend opening links under grok.me in an incognito window. It found a sales pipeline for 594 accounts, a hospital patient's lab results, and a timesheet that hands out its own admins' passwords — all behind nothing.

Claroc Research tried 43,551 addresses under grok.me, the domain where Grok publishes the apps people build in its Build mode. Of the 37,571 apps still online, 35,578 — 94.7 percent — opened for anyone with no sign-in at all, according to the firm's report. Only 1,993 returned the 401 error that an app set to "Only you" or "Invited users" is supposed to return.

The uncomfortable part is who else left the door open. Twenty-four of the public apps were built by SpaceXSI and X staff — the company formerly called xAI, and the company that makes Grok. Among them: a confidential onboarding plan for a new enterprise sales hire that listed the internal systems to request access to (Okta, Slack, HubSpot, Gong, a Grok workspace, Cursor) and 19 of the company's internal chat channels; a "North Central Territory Mapper" assigning 594 strategic accounts across six territories and ranking them by priority; eight X advertising proposals and media plans, one addressed to a U.S. federal agency and stamped confidential; four live advertiser account boards carrying campaign spend, one tracking progress toward a $1.6 million sales goal; and campaign reports for advertisers in Brazil, Japan, Korea and Thailand.

Claroc reported the onboarding plan and the federal-agency proposal to SpaceXSI on November 8 and the remaining staff apps the next day. SpaceXSI has since taken the 24 offline. It has not touched the roughly 35,000 open apps built by everyone else.

What else was sitting behind a link

Beyond the company itself, Claroc tied open apps holding internal data to 30 organizations it could identify. Twenty-six have more than 1,000 employees; six are in the Fortune 500. Eighteen are based in the United States, twelve in eleven other countries. By sector the list runs construction and real estate (7), energy and utilities (5), technology (4), healthcare and medical devices (3), transport and automotive (3), travel and hospitality (3), defense (2), manufacturing and advertising (2), and auto finance (1).

The cases the researchers confirmed by hand are the ones that will travel: a hospital group's staff event app with a searchable roster of more than 3,500 employees; an intensive-care briefing for a single patient listing labs, imaging and ventilator status; a cruise ship's galley inspection checklist with crew members' full names and employee IDs; a fire department's live shift board with names, badge numbers and duty hours; a trucking firm's recruiting list of more than 1,000 people with legal names and personal email addresses; and a contractor's staff timesheet whose client-side script contained all 18 employee accounts, admins included, with the password field in plain text.

Most of what Claroc opened was harmless — games, landing pages, calculators. About one in ten apps held something sensitive, and the firm rates roughly two percent as severe. Against a random sample it read by hand, it puts the real count of apps with private data at 650 to 800.

Four random words are not a secret

Grok gives every published app its own hostname, <name>.grok.me, and roughly half the names Claroc saw were four random words the builder never chose. That sounds like obscurity. It isn't, because the name does not have to be guessed: the first time anyone opens the link, the lookup lands in a commercial passive DNS database, and one pattern search returns the whole list.

ChatGPT handles the same two steps differently, which is the comparison that matters. When Claroc clicked Share on a ChatGPT-built app, access was set to "Only me" until it was changed, and the address is two levels deep and carries the account's username (<app-name>.<username>.chatgpt.site). A ChatGPT name found in DNS still leads to an app only its owner can open. Shared chats are a separate case: Claude artifacts, ChatGPT share links and Gemini share links keep the secret in the URL path, so DNS never sees it — though search indexing and link scanners still can, which is how 370,000 shared Grok conversations turned up in Google in August 2025.

The access check that always passes

From outside, Claroc could only see that apps were open. To test what Grok builds when nobody asks for security, the researchers built two apps of their own with invented data, and published both with whatever the dialog proposed — on the paid account used for testing, "Anyone with the link" was already selected.

The first, a contact list asked to save entries "so every visitor sees them," came back with a database and no sign-in; a stranger in an incognito window added a row and the next visitor saw it. The second, a customer list for a sales team of four, got sign-in buttons for Google and X that Grok added on its own — with a logic error underneath. The generated code adds whoever signs in to the team and then checks whether they are on it, so the check always passes. An outside Google account that had never been invited read every customer record, changed one and deleted another.

That ordering bug is the part that should worry buyers. Claroc ran its write and delete tests only on its own apps, and says nothing about the other 35,578. But if the same pattern is common, an open page is not merely a page anyone can read — it is a database anyone can edit.

Grok does have the right settings. Switched to "Only you," Claroc's first app answered 401 on both the page and its data function, and unpublishing the second took its address offline within seconds. Nothing pushes a builder toward either.

What SpaceXSI says

Asked by a reporter about the research, SpaceXSI said apps are private until their creator shares them, that publishing runs through several deliberate steps — Publish, choose an address, Publish again, pick between "Only you" and "Anyone with the link," accept a legal notice, Publish a final time — and that employee accounts default to "Only you," which is more friction than builders such as Lovable impose, The Decoder reported.

Claroc concedes that nothing goes public before a builder clicks Publish, and answers that the access step is the problem: the 35,578 open apps all went through those clicks, and the dialog still proposed "Anyone with the link" at the end of them. Its own employees' 24 apps are the proof that a stricter default for staff accounts did not hold.

There is an interest to declare on both sides. Claroc sells security tooling for AI-built apps and offers a 30-minute "exposure check" at the bottom of the report; SpaceXSI is defending a shipping product. The numbers are checkable, the method is described, and this is the firm's second pass at the same flaw: in October it found about 6,800 shared Muse conversations from Meta the same way. It is also at least the third privacy incident for Grok, after the 370,000 indexed conversations and a July 2026 Grok Build release that uploaded user files, SSH keys and password databases to company servers without asking.

If you have published a Grok app

The exposure is fixable in minutes by the person who built the app, and invisible to everyone else — which is the whole problem. The apps were made in the same chat window they were published from, by people whose job is a shift roster or a sales territory, and no IT ticket was filed. One enterprise Claroc cites had 500 AI-built apps, each one changing with the next prompt.

So: open your app's link from a browser you are not signed into and see whether it resolves. If it holds anything internal, switch access to "Invited users" or "Only you" and confirm a stranger now gets an error. Check the scripts the app loads for names, emails and passwords. And treat the same question as open on Lovable, Replit, v0, Bolt, Base44, Google AI Studio and ChatGPT, all of which publish to their own hostnames.

The same logic applies inside a company, though less comfortably: it took a passive DNS subscription to find these. Vibe-coded app hosting is now a product line in its own right — Automattic's Spacefast sells it at $5 a month — and almost none of it ships with the thing that would have prevented this, which is a default that says no.

What to watch: whether Grok flips "Only you" to the default for paid accounts, and whether a European data protection authority treats a preselected "anyone with the link" as a design failure rather than a user mistake. Ireland's regulator is already investigating X over Grok-generated imagery; patient lab values in an open app give it a much better case.

Do you audit the apps your team builds with AI — or would you rather not know what is out there? Write to us via our contact page.