Facts checked Nov 11, 2026
Claroc said on Nov. 10 that 35,578 apps built and published with Grok were open to anyone with the link, and that such links can be found through DNS data. For US companies this is a data-handling gap: find the apps staff published and lock them down this week.
What happened
In its Nov. 10 post, Claroc said it tried 43,551 Grok app addresses. It said 37,571 were still online and 35,578 of those (94.7%) opened with no sign-in. Another 1,993 returned HTTP 401, the error an app set to "Only you" or "Invited users" gives. All counts are Claroc's own.
Claroc says about 1 in 10 held sensitive material, internal business data or personal data; it estimates roughly 2% held material rated high or critical and 650 to 800 apps held private data. These rest on an AI model's flags checked against a hand-read sample. It described a hospital group's staff roster of more than 3,500 employees, an ICU briefing for one patient, and a timesheet whose browser-downloaded script held 18 accounts with plain-text passwords. Beyond SpaceXSI and X, Claroc said 30 other organizations had internal data in open apps (18 in the US, 6 Fortune 500), none named. Claroc said it loaded the first page of each app once, signed in to nothing, proved data could be changed only on its own two apps, and "did not sign in to, write to or test anyone else's".
A representative of Cursor, the AI coding service SpaceXSI recently acquired, said in an email quoted by Ars Technica that apps "are private by default and nothing goes public unless the creator chooses to share it." Claroc says SpaceXSI, answering a reporter's questions, said employee accounts are set to "Only you" by default. In Claroc's paid-account test, which Ars Technica dates to the week before Nov. 10, "Anyone with the link" was already selected. Claroc says SpaceXSI took down its staff's 24 apps on Nov. 10 following Claroc's report, but not other users' apps; Ars Technica says the removals began within a few hours of its emailed questions. SpaceXSI had not said, as of Nov. 11, that it would change the default or contact other app owners.
Why a secret link is findable
SpaceXSI has said each published app gets its own grok.me address. Opening one triggers a DNS lookup; passive DNS services collect those lookups and let account holders search them. Claroc says ChatGPT, Lovable, Replit, Base44, Google AI Studio and Meta's Muse also give each app its own hostname, and v0 and Bolt deploy to hostnames too. Path-based share links stay out of DNS but search engines can index them; Claroc cites more than 370,000 shared Grok conversations in Google in August 2025.
Who is affected
Any company whose staff can sign up for an AI builder on their own. As of Nov. 11, docs.x.ai lists Grok Business sharing policies for conversations, projects and skills only and documents no company-wide ceiling for apps.
What to do now
- IT, this week: find builders in use from proxy and DNS logs, company-email sign-ups in SSO logs and expense data (publishing needed a paid plan in Claroc's account).
- Security, this week: find company apps by asking teams and by listing the builder app hostnames that company devices looked up in your own resolver and proxy logs; open each from a signed-out browser.
- App owners, within 48 hours: set internal apps to "Invited users" or "Only you", confirm a stranger gets an error page, and unpublish ownerless apps. Unpublishing took Claroc's address offline within seconds.
- Security, this week: sign in from an outside account. Claroc's generated team login added the signer before checking membership, and its no-sign-in app let any visitor write data. Check the scripts each app loads for passwords and keys, and rotate any found.
- Data governance, this month: name data classes (PHI, credentials, customer personal data) barred from AI-built apps, require company sign-in for internal ones, record an owner per app. If personal data or PHI sat in an open app, counsel decides whether notification is required.
