An investigation by security firm Claroc identified 35,578 apps created with Grok that could be accessed without authentication, including systems with confidential business information and personal data. The survey, published on November 10, examined 37,571 applications still available on the internet, of which 94.7% allowed access without login.
Among the materials found were medical records of a patient in intensive care, employee lists, and a time-tracking system whose code contained passwords stored in plaintext. Claroc estimates that 650 to 800 apps contained relevant private information, although most of the accessible addresses corresponded to games, calculators, and ordinary pages.
The investigation also identified 24 apps published by employees of SpaceXSI, formerly known as xAI, and of the social network X. They included business plans, confidential advertising proposals, and a sales map with information on 594 strategic accounts. According to the researchers, those applications were taken offline after the results were reported.
How apps published with Grok became accessible
The researchers located the addresses through public DNS records, which make it possible to discover subdomains used by published applications. This means the links could be found even if they had not been shared directly with those who accessed them.
In tests with two of its own apps, Claroc found that the option “Anyone with the link” appeared preselected in the publishing interface of its paid account. In another test, an app intended for a team allowed an unauthorized Google account to view, change, and delete records.
SpaceXSI disputed the interpretation that the apps were published automatically. The company said that publishing requires several explicit actions from the creator and that its employees' accounts use private settings by default.
Claroc acknowledged that publishing depends on a user decision, but argued that the access setting offered during that process can leave information unprotected.
The findings do not mean that the 35,578 apps contained confidential data, nor that all of them allowed information to be modified. The record-alteration tests were carried out exclusively on the applications created by the researchers.
By the time the report was published, Claroc had begun notifying affected organizations. There was no confirmation of a general change in Grok's publishing settings.
