Grok's "Build" mode, from SpaceXSI (formerly xAI), turns a chat description into a working web app, and a click on "Publish" gives it its own address under grok.me. In its latest report, security firm Claroc says that of the 37,571 such apps it found still live, 35,578 can be accessed without signing in. That is 94.7%.
The exposed material includes patient lab values, a hospital staff roster, and internal files made by SpaceXSI and X employees themselves.
Two defaults stacked on top of each other
Claroc traces the problem to the publishing step. On the paid account it used for testing, the "Anyone with the link" option in the publish dialog was pre-selected.
The addresses are not hard to find either. Every app gets its own subdomain, and once the address is visited for the first time, the name lands in commercial passive DNS databases (databases that record the history of domain resolutions), which can be searched in bulk with simple rules. Public by default, combined with enumerable addresses, leaves the "you need the link to see it" protection largely hollow.
What leaked
According to Claroc, most of the public apps are small games, landing pages and calculators. About one in ten contains sensitive material, internal business data or personal information, and around 2% are particularly serious cases.
Confirmed examples include an ICU handover briefing listing a patient's lab values; a roster of more than 3,500 employees at a hospital group; a fire department's duty schedule; and a timesheet app whose source code contained plaintext passwords for 18 accounts. Besides SpaceXSI and X, 30 organizations were affected, six of them Fortune 500 companies. Claroc has not named them.
Among the 24 employee-made apps are a confidential training plan for a newly hired enterprise salesperson, listing internal system addresses and 19 internal chat groups; a map that sorts 594 strategic accounts into six sales regions and ranks them by priority; and eight X advertising proposals, one of them aimed at a US federal agency and marked confidential.
Grok's permission code has problems too
Using two test apps it built itself, Claroc found another class of flaw. A contact-list app generated a database with no login, so anonymous visitors could write entries into it directly.
The other was a sales team's customer list. Grok added Google and X sign-in on its own, but the code added every successfully authenticated user to the team first and only then checked membership, so any outside Google account could read, edit and delete records. Claroc says its write and delete tests were run only on its own apps.
Where competing products differ on defaults
Across products, the default on the share button decides most of the outcome. Claroc used ChatGPT as a comparison: a newly created app defaults to "Only me" when shared, and its address also shows up in DNS data, but when opened only the owner can use it. Grok also has an "Only you" option, and in testing, switching to it blocked outside access; it just is not the default.
Sharing features have caused trouble beyond Grok. Using the same passive DNS method, Claroc found about 6,800 shared conversations with Meta's agent Muse in October. In July this year, shared Claude conversations and Artifacts from Anthropic also appeared in search engines, including apps users had built. For Grok itself, this is at least the third privacy incident: in August 2025, Forbes found more than 370,000 shared Grok conversations in Google search, and in July 2026 the terminal tool Grok Build was reported to upload user files without asking, including SSH keys and password vaults.
What the company says
SpaceXSI's response was brief: apps are private until the creator shares them, publishing involves several steps including a legal notice, and employee accounts default to "Only you". Claroc counters that as long as the final step still pre-selects "Anyone with the link", extra clicks do not stop anyone, and the 24 employee apps show that the employee-account default did little to help.
SpaceXSI has taken down those 24 employee apps, while public apps from other users and organizations remain online. The company has not promised to contact all affected owners, and Claroc is notifying them one by one for now. It proposes three fixes: default to "Only you" and show who can access an app before publishing; warn when an app has a database but no login; and use hard-to-guess paths on a shared host instead of individual subdomains.
Claroc itself sells security products for AI-generated apps. The percentages and cases above come only from its own figures and have not been independently verified.
Sources: Claroc security report, The Decoder, CocoLoop; the 94.7% figure, the number of affected organizations and the number of employee apps are Claroc's figures, and SpaceXSI's response is as given to the researchers.