Researchers found 35,578 Grok-built apps that anyone could open, some with private data

Grok, the AI assistant from SpaceXSI (the company formerly called xAI), can build a working web app from a description typed into its chat and publish it at its own address under grok.me. Security company Claroc published research on November 10, 2026, which it calls GhostShares 2, showing that tens of thousands of those apps open for anyone, and that some hold data that was never meant to be public. The Hacker News covered it on November 11. Here’s what the researchers showed, and where the limits of their findings are.

How the apps were found

Every published Grok app gets its own hostname. When anyone opens one, their computer looks that name up in DNS, and commercial passive DNS services record those lookups and let customers search them by pattern. Claroc says that’s how it built its list: it never needed anyone to share a link. Grok suggests four random words as an app’s name, which nobody would guess, but a name that already sits in a searchable list doesn’t need guessing.

Claroc loaded the first page of each app once, from the public internet, without signing in.

What they found

• Claroc tried 43,551 addresses. 37,571 apps were still online, and 35,578 of them (94.7%) opened for anyone with no sign-in.
• Most were games, landing pages and calculators. About 1 in 10 held internal business or personal data, and Claroc estimates roughly 650 to 800 apps held private data.
• 24 open apps were built by SpaceXSI and X staff, including a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a US federal agency marked confidential.
• Apps from 30 other organisations Claroc could identify held internal data. 26 have more than 1,000 employees and six are Fortune 500 companies, across construction, energy, healthcare, transport and defence.
• Examples Claroc confirmed by hand include a hospital group’s searchable list of more than 3,500 staff, an intensive care briefing on one patient, a fire department’s live shift board, and a contractor’s timesheet whose code, downloaded by every visitor’s browser, held each employee’s password in plain text.

What Claroc tested on its own apps

To see what security Grok adds when nobody asks, Claroc built two test apps with made-up data and published them with the access setting Grok proposed, which in its paid account was “Anyone with the link”.

• A contact list got a database and no sign-in. From a private browser window, the researchers added a row that the next visitor saw.
• A customer list “for a sales team of 4” got “Continue with Google” and “Continue with X” buttons. But the code Grok wrote added anyone who signed in to the team before checking whether they belonged. An uninvited Google account got in, viewed every customer, edited one record and deleted another.

Demonstrated, and not

What Claroc demonstrated: that tens of thousands of Grok apps opened without sign-in; that some of those, which it read, contained the data described above; and that its own two test apps could be changed by strangers.

What it did not test: Claroc says it didn’t sign in to, write to or test anyone else’s app. So it hasn’t shown that the open apps it found can be edited, only that apps built the same way can be. Its count of 650 to 800 apps with private data is an estimate based on an AI model’s flags checked against a hand-read sample.

What SpaceXSI says

Claroc reported its findings to SpaceXSI on November 8 and 9. By publication the company hadn’t replied to the report, but it answered a reporter’s questions. According to Claroc, SpaceXSI said Grok apps stay private until their creator shares them, that publishing takes several steps including a legal disclaimer, and that employee accounts are set to “Only you” by default. SpaceXSI took down the 24 staff apps after the report, but not other users’ apps. Claroc asked the company to make “Only you” the default for everyone and to add a setting that limits an app to a company’s email domain. It has started emailing affected organisations itself and withheld every app address from its report.

What you can do

If you’ve built and published something with Grok or another AI app builder:

1. Check who can open it. In Grok, set apps that hold anything private to “Invited users” or “Only you”. Claroc found that “Only you” made its app return an error to strangers.
2. Try it from outside. Open the app in a private window, and sign in with an account that shouldn’t have access. If you get in, the app needs a proper list of who is allowed.
3. Don’t put passwords, patient details or customer records in a quick AI-built app unless it has real sign-in and access checks.
4. Unpublish apps you no longer use. Claroc says unpublishing took a Grok app offline within seconds.

If you work in IT, find out which AI app builders your colleagues use. Claroc lists Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio, which can all be used without IT setting them up.

How Frame helps

These apps aren’t a breach with a list of affected email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan AI-built apps.

Related coverage

• Thousands of app databases are readable by anyone, UpGuard finds: the same problem one layer down, in the databases behind quickly built apps.
• Wyndham’s Android app held a password that opened a customer database: another case of a password shipped to every user’s device.

Sources

• Claroc Research, GhostShares 2: Grok Apps Exposed xAI’s Business Secrets and People’s Private Data, November 10, 2026
• The Hacker News, Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords, November 11, 2026