Claroc finds 35,578 Grok-built apps open to anyone, including SpaceXSI's own sales data

The company that makes Grok had its own sales plans open, and its publish button proposed Anyone with the link.

By Think Facility · November 11, 2026 · SpaceXSI AI security

On November 10, 2026, the security company Claroc published research showing that almost every app people had built and published with Grok could be opened by anyone. Of 37,571 Grok apps still online, 35,578 (94.7%) loaded for a stranger who wasn't signed in to anything.

Some of those apps belonged to the company that makes Grok. Claroc found 24 open apps built by SpaceXSI and X staff, including a confidential onboarding plan for a new member of SpaceXSI's enterprise sales team and a sales territory map of 594 strategic accounts.

Apps tried: 43,551 Grok app addresses
Still online: 37,571
Open to anyone: 35,578 (94.7%)
SpaceXSI and X staff: 24 open apps
Other organizations identified: 30, six of them in the Fortune 500
Holding private data: roughly 650 to 800 apps, by Claroc's estimate

How strangers found the links

Grok Build turns a description typed into the chat into a working app, and SpaceXSI opened it to every plan in August. Each published app gets its own web address on grok.me, and that's where the trouble starts.

A long white and glass building with large SpaceX lettering across its front, trees along the entrance and a black sedan parked outside under a clear blue sky — SpaceX's headquarters in Hawthorne, California. SpaceXSI, which makes Grok, is the company formerly called xAI. Photo: SpaceX, CC0, via Wikimedia Commons

When someone opens one of those addresses, their computer looks the name up in DNS. Passive DNS services collect those lookups and let paying customers search them by pattern. So the first time the intended audience opens an app, its name lands in a commercial index. Claroc's researchers say they pulled 43,601 names under grok.me this way.

Grok suggests four random words as each app's name, which nobody would guess. That doesn't help when a database lists them. Shared chats on Claude, ChatGPT and Gemini keep the secret part of the link in the path after the domain, where DNS never sees it, though Claroc points out that search engines can still index those pages.

The second problem is the default. In the paid account Claroc used, the publish panel offered Anyone with the link, Invited users and Only you, with Anyone with the link already selected. SpaceXSI's own launch page for Grok Build shows a mock-up of that panel set the same way.

What was inside

Most open apps were games and calculators. Claroc says about 1 in 10 held sensitive material, and among the ones it confirmed by hand were a hospital group's roster of more than 3,500 employees, an intensive care briefing for a single patient and a contractor's timesheet that shipped every employee's password in plain text to the browser.

The researchers also built two test apps of their own. In one, a team app Grok had given a Google sign-in, any Google account could get in, because the code added whoever signed in to the team before checking whether they belonged. They only tested that on their own app, and they say an open app elsewhere may be writable too.

AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone

Grok Apps Exposed xAI Secrets and Private Data | Claroc Blog

What SpaceXSI said

SpaceXSI didn't reply to Claroc's report, according to the researchers, but it did answer a reporter's questions. Claroc's summary of that answer is that apps stay private until their creator shares one, that publishing takes several clicks and a legal disclaimer, and that employee accounts default to Only you.

Claroc's reply is that the extra clicks end on a setting that's already open to everyone. After the report, SpaceXSI took down the 24 staff apps. Claroc says it hasn't done the same for anyone else's, so the researchers started emailing affected organizations themselves on November 10. This is the second time in two months Claroc has found this kind of exposure; in October it was Meta's Muse share links.

When a patient's chart ends up in a chatbot app

The intensive care briefing is the case with legal weight. Under the HIPAA Breach Notification Rule, as HHS describes it, a hospital or other covered entity that discloses unsecured patient information has to tell the patients affected without unreasonable delay and in no case later than 60 days after it finds out. A breach of 500 or more people also has to be reported to the HHS Secretary on the same clock.

An impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised

From Breach Notification Rule | HHS.gov

Claroc doesn't name the hospital, so I can't say whether that rule applies to this app or who'd have to send the notice. The clock only starts when someone discovers the breach, though, and with the hostnames withheld, the organizations can only learn about it from Claroc or from SpaceXSI. Claroc says it had emailed three of them by publication.