35,578 of 37,571 apps built with Grok were still accessible without signing in when Claroc reviewed them. The security firm found medical data, plaintext passwords, and internal SpaceXSI and X documents among them; 24 apps belonged to employees of those two organizations.
The count represents 94.7% of the apps that were still online. Claroc published its findings on November 10, 2026. SpaceXSI took down its employees’ 24 apps after being asked about the case, but apps belonging to other users and organizations remained open when the investigation was published.
Patient data, schedules, and credentials
Most of the exposed apps were games, presentation pages, or calculators. Claroc estimates that about one in ten contained personal information, internal business data, or sensitive material, and estimates that between 650 and 800 apps stored private data. Approximately 2% of all open apps contained material the firm classified as high or critical severity.
Among the cases the researchers manually confirmed was an app belonging to a hospital group, with a searchable directory of more than 3,500 employees and an intensive care presentation about a patient, including lab results, images, and ventilator status. They also found a fire department’s shift schedule, with names, badge numbers, and duty hours.
A contractor’s time-tracking app caused another particularly sensitive exposure: its code included 18 accounts and passwords in plaintext, including those of administrators. That code was downloaded to every visitor’s browser. Claroc did not publicly identify that organization or the other 30 whose internal data it was able to attribute to specific companies.
Of those 30 organizations, 26 had more than 1,000 employees and six were on the Fortune 500 list. Claroc placed the cases in sectors including construction, energy, technology, healthcare, transportation, travel, and defense. Its post also detailed a record of more than a thousand drivers with legal names and personal email addresses, and a cruise ship crew list with full names and employee identifiers.
SpaceXSI and X’s internal documents
Among the 24 employee apps was a confidential onboarding plan for a new member of SpaceXSI’s enterprise sales team. It included internal systems, team tools, 19 chat channels, colleagues the new hire was expected to meet, and a plan for their first 30 days.
Another app showed a sales territory map with 594 strategic accounts, divided by region and accompanied by sales funnel data. Claroc also found eight X advertising proposals and plans, including a proposal for a U.S. federal agency marked confidential.
The inventory included four active advertising account dashboards showing campaign spend, one of them linked to a $1.6 million sales target; seven reports for advertisers in Brazil, Japan, Korea, and Thailand, several marked confidential or for internal use; and two copies of an X brand safety manual. Only one of the SpaceXSI or X apps Claroc found required a password: a file of advertising measurement studies from a streaming service.
SpaceXSI, formerly called xAI, makes Grok. Its employees and those of X generated the apps using Grok Build, a mode in which users describe what they need in a chat and the assistant writes the code. The company had explained that each published app gets its own address on grok.me and that the person who creates it decides who can access it.
The open option was selected by default
An app is not published until its creator clicks “Publish.” In the paid account Claroc used, the panel that appeared afterward offered three options: “Anyone with the link,” “Invited users,” and “Only you.” The first, which allows anyone who reaches the address to access it, was already selected.
SpaceXSI told journalists that apps remain private until their creator decides to share them, that publishing requires several steps, and that employee accounts default to “Only you.” The company also mentioned a legal notice in the process. Claroc does not dispute that those steps must be completed; it points out that, in the account it tested, the final access setting already allowed anyone with the link to get in.
The address could be discovered even if the creator had not sent it to anyone else. Each app gets a grok.me subdomain. When someone opens the page, their device queries the DNS system to locate it; commercial passive DNS services record those queries and allow names to be searched by pattern. Claroc says this is how it was able to find addresses its researchers had never received directly.
Grok suggested four-word random names for apps, a format that is difficult to guess. But once an address appears in those records, there is no need to guess the name: it is enough to find it in a searchable database. Engadget adds that the random words were placed to the left of the domain, unlike the structure it attributes to Gemini. The exposure, therefore, did not depend solely on the link being easy to guess.
Claroc tested 43,551 Grok addresses and found that 37,571 were still online; of these, 35,578 opened without authentication. The remaining 1,993 returned an access error consistent with the “Only you” or “Invited users” settings. The firm says it loaded the first page of each address once, from the internet and without signing in.
Two in-house tests revealed control failures
To check what protections Grok generated in the code, Claroc built two test apps with invented data. For the first, it requested a contact list that all visitors could view. Grok added a database, but no authentication. From a private browsing window, without signing in, the researchers added a row that then appeared for the next visitor.
The second app was a customer list for a four-person sales team. Grok added buttons to sign in with Google or X. However, according to Claroc, the code first added any authenticated user to the team and then checked whether they belonged to it; since it had already added them, the check did not exclude them. A Google account unrelated to the owner was able to view all the records, edit one, and delete another.
Claroc expressly limits the scope of this test: it performed write and delete operations only on its own apps. It did not sign in to or attempt to modify any of the third-party apps it found. Therefore, it did not determine how many of them also allowed data to be changed, in addition to being read.
The firm confirmed that the “Only you” setting did block external visitors in its tests: both the page and the data returned a 401 error. It also verified that unpublishing took an app offline within seconds. The issue it identified is that these controls were not the default option in the paid account it tested.
SpaceXSI took down its apps; Claroc notified other companies
Claroc notified SpaceXSI on November 8 using the address listed in its security.txt file and sent details about the other employee apps on the 9th. Coverage by Sulat and other publications places the removal of the 24 apps after Ars Technica asked about the case. Claroc said the company had not taken down apps belonging to other users and had not confirmed that it would contact their owners.
The firm offered to share the full list of addresses privately. After receiving no commitment from SpaceXSI to notify those affected, it began contacting the organizations directly; it had written to three by the time it published its investigation. Claroc did not disclose the names of the companies or the addresses of the exposed apps.
“We were shocked. The company that makes Grok had its own internal material open to anyone holding the link, and we had never been given it.”
— Claroc, in its GhostShares 2 report
Claroc proposed four changes: host shared apps under hard-to-guess paths on a single domain, rather than assigning each one a subdomain; set “Only you” as the default; offer access limited to an organization’s email accounts; and warn users before publishing if an app has a database but no authentication.
In its report, the firm also compared the setting with ChatGPT’s: in the app it shared to test it, access was limited to the owner until the setting was changed. This does not eliminate the possibility that the address will appear in DNS records, but, according to Claroc’s tests, anyone who finds it cannot open it if access remains restricted.
The case adds to earlier incidents involving Grok cited in the coverage. In August 2025, Forbes found more than 370,000 shared Grok conversations in Google Search. In July 2026, reports said that the Grok Build terminal tool had uploaded user files to the company’s servers without permission, including SSH keys and password databases. Claroc had also described in October how shared pages from Muse, Meta’s agent, could be found.
By the time of the November 10 and 11 reports, the 24 apps belonging to SpaceXSI and X employees had been taken down. Claroc said that other apps remained open and that it had received no public confirmation that the changes it proposed had been implemented.
Sources: The Decoder, Engadget, The Hacker News, Claroc Blog, FrameSignal, Tbreak Media UAE, Sulat AI & Tech News
