Security firm Claroc says tens of thousands of Grok Build apps were open to anyone who found their web address. Its report, published November 10, 2026, counts 24 such apps built by SpaceXSI and X staff. Build is the mode in Grok that writes an app from a chat prompt and publishes it under the grok.me domain. Grok is the assistant from SpaceXSI, the company formerly called xAI.
Claroc says it tried 43,551 Grok app addresses. Of the 37,571 still online, 35,578, or 94.7%, opened with no sign-in. Most were games, landing pages and calculators. Still, Claroc estimates that about 1 in 10 held sensitive material and roughly 650 to 800 held private data.
What SpaceXSI and X staff left open
Claroc lists 24 open apps built by SpaceXSI and X employees. One was a confidential onboarding plan for a new enterprise sales hire. Another was a sales territory map of 594 strategic accounts. Claroc also found eight X advertising proposals, including one to a US federal agency marked confidential. Four advertiser account boards with campaign spend and two copies of an internal X brand safety playbook were on the list too. Only one SpaceXSI or X app it found asked for a password.
SpaceXSI took down those 24 apps after Claroc reported them and Ars Technica asked about them. Claroc says the company has not done the same for open apps belonging to other Grok users.
Other organizations and personal data
Beyond SpaceXSI and X, Claroc says open apps held internal data from 30 organizations it could identify. They include 26 with more than 1,000 employees and six Fortune 500 companies. Claroc does not name them.
For example, apps it confirmed by hand include a hospital group’s roster of more than 3,500 employees and an intensive care briefing on a single patient. Claroc also found a fire department’s live shift board and a timesheet whose code held staff passwords in plain text. It says it has started notifying affected organizations itself.
How Grok Build apps became findable
Each published Grok app gets its own hostname under grok.me. When someone opens the app, Claroc explains, passive DNS services can record the lookup for that name. Subscribers to those services can then search recorded names by pattern. As a result, people who never received the link can still find the address.
In the paid account Claroc used, the publish panel offered Anyone with the link, Invited users and Only you. Anyone with the link came preselected. Claroc also built two test apps. In one, a team app with Google sign-in, an uninvited Google account could read, change and delete records. Claroc says it ran that test only on its own apps.
AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone.
Asaf Aprozper, Claroc Research
What the company says
A representative for Cursor, the AI coding company SpaceX acquired in August, responded to Ars Technica by email. The representative said Grok Build “apps are private by default and nothing goes public unless the creator chooses to share it.” Ars reported that Claroc’s tests contradict that statement. According to Claroc, SpaceXSI also said publishing takes several steps and that employee accounts default to Only you.
What owners of Grok Build apps can check
Claroc sells security tools for AI-built apps. It recommends that any Grok app holding internal data use Invited users or Only you. It also tells owners to confirm that a stranger gets an error page. Unpublishing takes a grok.me app offline at once. Claroc adds that Lovable, Replit, v0, Bolt and other builders also give each app its own hostname. It says the same discovery method works on them.
