Security researchers at Claroc have identified more than 35,000 applications built with the Grok AI assistant that were left exposed on the internet, with many containing confidential business and personal information.
Of the 37,571 Grok-built apps discovered online, 35,578 were accessible without any sign-in requirement. The researchers noted that 24 of these applications were created by staff at the social network X and at SpaceXSI, the company behind the Grok AI assistant. The exposed staff applications included a confidential onboarding plan for a new sales hire, a sales territory map covering 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential.
Most of the publicly accessible apps were simple games, landing pages, and calculators. However, approximately one in ten contained internal business or personal data. In total, the researchers identified internal data belonging to 30 additional organizations spanning construction, energy, healthcare, and defense sectors. Of these organizations, 26 employ more than 1,000 people and six are Fortune 500 companies.
According to Claroc's estimates, roughly 2% of the exposed apps contained material serious enough to be rated high or critical severity. Examples included a hospital group's searchable list of more than 3,500 employees, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet application that stored every employee's password in plain text.
Grok gained the ability to generate working applications from natural language descriptions on August 19. Each published app receives its own subdomain under grok.me, and creators can choose between access settings labeled "Anyone with the link," "Invited users," or "Only you." The researchers found that the default selection was frequently left as "Anyone with the link," and because subdomain names appear in passive DNS records, the applications could be discovered through standard subdomain enumeration techniques.
In contrast, the researchers observed that ChatGPT's comparable app builder defaults to a private setting. They also noted that Meta's Muse AI agent had previously faced similar exposure issues that were later addressed by changing shared item addresses.
Claroc reported the findings to SpaceXSI through its security.txt contact address. While the company removed the 24 staff applications, it has not confirmed plans to notify other affected users. The researchers have begun directly contacting impacted organizations themselves.
