Security Firm Finds 35,578 Grok-Built Apps Open to Anyone, Some Exposing Passwords

Claroc found 37,571 Grok-built apps still online, and 35,578 of them needed no login. Most were harmless games, landing pages and calculators. But the researchers estimated that about one in 10 held internal business or personal data, and about 2% held material they rated high or critical, according to The Hacker News's account of the research. Among 24 open apps built by staff at SpaceXSI, formerly xAI, and X were a confidential onboarding plan for a new sales hire, a sales territory map covering 594 accounts, and an X advertising proposal to a US federal agency marked confidential.

Nobody hacked these apps. The exposure came from a default setting, which matters for any company whose staff build internal tools with AI app builders. When a user published an app, Grok offered three sharing options: "Anyone with the link", "Invited users" and "Only you". The first was already selected. By contrast, ChatGPT's app builder set shared apps to "Only me" unless the owner changed it, the researchers noted.

Each Grok app gets its own grok.me web address. Opening an app creates DNS lookups that passive DNS services record, and anyone with an account on those services can search the records by pattern. Grok suggests names made of four random words, and about half the apps found used one. The researchers said a random name does not protect an app once its address sits in a searchable list.

Apart from the staff apps, the researchers found internal data from 30 identifiable organisations in construction, energy, healthcare and defence. Twenty-six of them have more than 1,000 employees and six are Fortune 500 companies. The exposed material included a hospital group's searchable list of more than 3,500 employees, an intensive care briefing on one patient, a fire department's live shift board, and a contractor's timesheet code that held every employee's password in plain text.

The researchers also built two test apps with invented data. In one, the sign-in code that Grok generated added each signed-in user to the team before checking whether they belonged, so an uninvited Google account could view, edit and delete records. The researchers did not establish whether anyone malicious had accessed the real data.

SpaceXSI said that "Grok apps stay private until their creator shares them". It said publishing takes several steps, including choosing a sharing setting and accepting a legal disclaimer, and that employee accounts default to "Only you". It has since taken the 24 employee apps offline, The Decoder reported, but has not removed other users' open apps or committed to contacting their owners. Claroc has asked SpaceXSI to make "Only you" the default and to offer a setting that limits an app to a company's email domain, and it has begun notifying affected organisations itself.

The app builder opened to all Grok plans on August 19. It is separate from Grok Build, the company's terminal coding tool. In October the same researchers found that pages shared from Meta's Muse AI agent could also be discovered through passive DNS. Meta disabled sharing and released a fix on October 22.

The researchers advise companies to set any app that holds internal data to "Invited users" or "Only you" and to check app code for hard-coded credentials. In their tests, the "Only you" setting returned an access error to strangers, and unpublishing an app took effect within seconds.