Researchers say more than 35,000 Grok Build apps exposed data without sign-in

Claroc Research said 35,578 published Grok Build apps were accessible from the public internet without sign-in. The exposed information included corporate plans, patient records, employee rosters and passwords. The security firm said 24 apps built by SpaceXSI and X staff were taken offline after its disclosure, while apps belonging to other users and organizations largely remained accessible when the research was published.

Claroc’s investigation found 37,571 apps that were still online when tested. Of those, 35,578, or 94.7%, opened without authentication; the remaining 1,993 returned an HTTP 401 response associated with the product’s restricted settings. Claroc attributed internal data in open apps to 30 organizations beyond SpaceXSI and X, including 26 organizations with more than 1,000 employees and six Fortune 500 companies.

Claroc documented a searchable hospital-group roster with more than 3,500 employees, an intensive-care briefing containing laboratory, imaging and ventilator details, crew and firefighter identifiers, a recruiting list with legal names and personal email addresses, and a staff-timesheet script containing 18 accounts with plaintext passwords. The 24 SpaceXSI and X staff apps included a confidential onboarding plan, a territory map covering 594 strategic accounts, advertising plans, live advertiser boards, campaign reports and copies of an internal brand-safety playbook.

The exposure stemmed from Grok Build assigning a separate <name>.grok.me hostname to each published app. Claroc said the randomized names were difficult to guess one by one, but passive DNS services collect hostnames observed during DNS lookups and allow pattern searches. Once intended users opened the links, those records made the app names enumerable, weakening possession of an obscure address as an access control.

Claroc said it found app names using common subdomain-discovery techniques. It loaded only the first page of each discovered app once without signing in, saved the pages and reviewed the copies offline. An AI model flagged pages that appeared private, and researchers manually checked the flagged set. Claroc said it did not sign in to third-party apps, submit forms, call server functions or use any passwords or keys it encountered. All write and delete tests were confined to two apps the researchers created with fabricated data.

Publishing still required an explicit action in Claroc’s paid account, but the access panel opened with Anyone with the link selected ahead of Invited users and Only you. SpaceXSI said apps stay private until a creator chooses to share them, publishing involves several steps and employee accounts default to Only you. Claroc agreed that builders had to publish an app, but said the ordinary paid account it tested preselected public link access at the subsequent access step.

On its own test apps, Claroc found that a contact app with no login let an unsigned visitor add a record. A second app intended for a four-person sales team offered Google sign-in, but its generated code added a user to the team before checking membership, allowing an uninvited account to view and alter records. The researchers did not test whether other people’s apps could be modified.

This share-link disclosure is separate from the earlier Grok Build CLI repository-upload finding. That issue concerned the CLI sending tracked repository files, Git history and session traces to vendor-controlled cloud storage, independently of which files the agent needed. The new research concerns apps that builders chose to publish, whose individual share hostnames could then be enumerated and opened without authentication.

Claroc said it notified SpaceXSI on November 8 with counts, two test apps, proposed fixes and two examples involving company data, then sent 22 more SpaceXSI and X examples on November 9. By publication, all 24 staff-app links returned app-not-found errors. The responses documented by Claroc did not commit to removing other users’ apps, changing the ordinary-user sharing default or notifying every affected owner; Claroc said it began contacting other organizations itself on November 10.