Almost every app built with Grok could be opened by anyone with the link
A security research firm found 35,578 apps built with Grok open to the public, some holding patient records and passwords. If your staff build apps with AI, check who can see them.
The short version
- A security research firm checked 37,571 apps that people built with Grok, the AI assistant from SpaceXSI (formerly xAI). Of those, 35,578 opened for anyone, with no sign-in.
- About 1 in 10 held something sensitive like staff lists and a patient's lab results. Some even held passwords in plain text.
- The cause is a default setting. When you publish a Grok app, "Anyone with the link" is already selected, and the links are easy to find.
What the researchers found
Grok has a Build mode. You describe an app in the chat, and Grok writes it. Click Publish, and the app gets its own web address on grok.me.
On November 8, the research team tried 43,551 of these addresses. Of these, 37,571 were still online. And 35,578 of those opened for anyone. That is 94.7%.
Most were harmless: games, landing pages and calculators. About 1 in 10 held something sensitive, such as internal business data. The firm estimates that roughly 650 to 800 apps held private details about people.
The cases it confirmed by hand are the kind of thing any company keeps:
- a hospital group's staff app listing more than 3,500 employees;
- a briefing on a single intensive care patient, with lab results;
- a fire department's shift board with names and badge numbers;
- a staff timesheet whose code held 18 accounts with passwords in plain text.
SpaceXSI's own staff were caught too. SpaceXSI and X employees had 24 open apps. They included a confidential onboarding plan for a new sales hire and a map of 594 sales accounts. There were also advertising proposals, one of them to a US federal agency.
Beyond SpaceXSI and X, 30 organizations had internal data in open apps. Among them are 6 Fortune 500 companies. The firm has not named them.
Why the links were easy to find
A link nobody shares can still be found.
Each Grok app gets its own web address. The first time anyone opens it, their computer looks that address up. Commercial services record these lookups and sell searchable lists. One search can list thousands of Grok app addresses.
The default setting makes it worse. In the paid account the researchers used, "Anyone with the link" was already selected at the last step of publishing. Grok also offers "Invited users" and "Only you". Those settings work, but nothing prompts the builder to pick them.
The researchers also built 2 test apps of their own. One stored data with no sign-in, so any visitor could add entries. For the other, they asked for a customer list for a sales team of 4 people. Grok added a Google sign-in on its own. But its code let any Google account in. So any stranger with a Google account could read, change and delete customer records.
SpaceXSI told a reporter that apps stay private until their creator shares them, and that publishing takes several steps. It took down its own staff's 24 apps after the report. It has not removed the open apps of other users.
What this means for a company in Indonesia
The apps in this report ran sales pipelines and staff rosters. Bought as software, each would have come with company sign-in and an admin who controls access. Built in a chat window, they went live behind a public link in minutes. IT never saw them.
Grok is not the only tool built this way. The researchers say several AI app builders give each app its own web address, which makes it findable in the same way. ChatGPT does this too, but its new apps start as "Only me".
Anyone in sales or HR can now publish a working app before lunch. The data inside it still belongs to your customers and your staff.
What to do this month
- Ask who builds apps with AI. These tools need no IT rollout, so you may not know who uses them.
- Check the access setting on every published app. Anything internal should be limited to invited users or the owner.
- Open each app in a private browser window, signed out. A stranger should see an error page.
- Try signing in with an account from outside your company. If it gets in, the app needs a list of who may use it.
- Look for names and passwords in what the app loads, and unpublish anything nobody owns.
- Write a one-page rule on what data may go into an AI-built app, and who approves publishing it.