Anyone with the link could open 35,578 apps built with the Grok app builder, and some held patient records and internal sales data.
The firm found 37,571 of the apps still online, and 35,578 of those (94.7%) opened for anyone, with no sign-in, according to Claroc’s report, published on 10 November. Anyone who builds an app by describing it to an AI tool makes the same final choice about who sees it.
Claroc, which sells tools to find and secure AI-built apps, blames the publish step. In the paid account it used, clicking Publish offered “Anyone with the link”, “Invited users”, and “Only you”, and the first was already selected.
Engadget, which reported the same research, says Grok puts the four random words to the left of the domain, not the right as Google’s Gemini does. According to The Decoder, each app’s name then shows up in passive DNS databases, which can be searched by pattern.
The most striking examples come from SpaceXSI, formerly xAI. Staff at SpaceXSI and X built 24 of the open apps, including a confidential onboarding plan, a sales territory map of 594 accounts, and eight X advertising proposals. Engadget reports that SpaceXSI took those 24 apps down within hours of Ars Technica’s questions.
Claroc also identified 30 other organisations, 26 with more than 1,000 employees and six on the Fortune 500. It doesn’t name them. Examples include an ICU patient’s lab results, a hospital group’s staff list, and a timesheet app whose source code held 18 accounts with plaintext passwords.
Most open apps were games, landing pages or calculators. Claroc estimates 650 to 800 held private data, and roughly 2% held material serious enough to rate high or critical.
SpaceXSI has told reporters that apps stay private until their creator shares them, that publishing takes several steps including a legal notice, and employee accounts default to “Only you”. Claroc replies in its report:
Extra clicks on a path that ends with access already set to everyone do not protect the data: the people who published the 35,578 open apps went through every one of those steps.
Asaf Aprozper, Claroc Research
AI coding tools have leaked data through settings before, such as Claude Code’s “don’t ask again” button, leaking secrets to GitHub. Check the access setting before you click Publish on any app an AI builder makes. Claroc’s test found that “Only you” gave a stranger an error page, so also test your own app that way. NVIDIA App’s AI-agent server also appears enabled by default, and you can turn it off.
Claroc says the apps of other Grok users and organisations remain open, and it’s contacting their owners itself because SpaceXSI hasn’t committed to doing so. It’s unclear whether SpaceXSI will take them down.
