Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords

Researchers found that apps built with Grok’s app builder are open to Anyone online. Thousands of these apps hold private business data, staff details, plain-text passwords, and patient information. No hacking was needed to reach them.

Grok’s Build mode creates and publishes chat-generated apps under grok.me, while its parent company, SpaceXSI (formerly xAI), did not respond to Claroc but answered media questions on November 10, 2026.

On November 8, 2026, Claroc researchers worked through a list of more than 43,500 grok.me addresses. They opened the first page of each app once, signed in to nothing, like any visitor in a private browser window. Of the 37,571 apps still online, 35,578 (94.7%) opened for Anyone. Only 1,993 asked for a sign-in.

The list came from passive DNS, a service that records website name lookups and lets Anyone search them. Each Grok app gets its own address, so the name enters those records once someone opens the app.

Grok AI App Builder Exposes Data

The researchers say Grok’s four-random-word names are hard to guess, but nobody needs to guess them because the records list them. The same method exposed Meta’s Muse, as covered in our Meta Muse AI privacy flaw report.

Most open apps were games, landing pages, and calculators. About one in ten held sensitive or internal data, and roughly 2% were serious enough to rate high or critical.

Confirmed examples include an intensive care briefing with a patient’s labs and ventilator status, a hospital group’s roster of more than 3,500 employees, and a fire department’s shift board with badge numbers. One contractor’s timesheet app held 18 staff accounts with plain-text passwords in code that every visitor’s browser downloads.

SpaceXSI and X staff also left 24 apps open. They included a confidential onboarding plan, a sales map of 594 accounts, and advertising proposals, one aimed at a U.S. federal agency.

Another 30 identifiable organizations had internal data exposed. Of these, 26 have over 1,000 employees, and six are Fortune 500 companies. SpaceXSI took down its own 24 apps after the report, but not those of other users.

Claroc found that paid-account apps defaulted to public link access, allowing anyone to view and add records to apps without login protection.

A team app with Google sign-in checked who the visitor was but not whether they belonged to the team. A stranger with a Google account could read, edit, and delete customer records. The researchers tested this only on their own apps.

SpaceXSI says apps stay private until the creator shares them, and that publishing takes several steps. Claroc replies that every owner of the 35,578 open apps went through those same steps.

Teams should find out which AI app builders their staff use, since tools like Lovable, Replit, and Grok need no IT approval. Check each app’s access settings, and test sign-in with an outside account. Look in the app’s script files for passwords and unpublish anything nobody owns. Unpublishing a grok.me app takes it offline within seconds.

This is not Grok’s first exposure problem. In 2025, more than 370,000 shared Grok chats appeared in Google search, which we covered in our report on Grok chats exposed in Google results. The comprehensive research is on the Claroc blog.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords appeared first on Cyber Security News.