Researchers at Claroc found that almost 95% of the live web apps built with Grok’s app builder could be opened by anyone on the internet, no login required. Roughly one in ten held internal business or personal data, including apps made by staff at SpaceXSI and X themselves.
What happened
On 10 November 2026 Claroc Research published “GhostShares 2”, an investigation into apps created with Grok, the AI assistant from SpaceXSI (the company formerly known as xAI). Grok can generate a small working web application from a prompt and publish it under the grok.me domain. Claroc enumerated those published apps and found 37,571 still online. Of those, 35,578 loaded for an anonymous visitor without any form of sign-in.
Most open apps were harmless games and calculators, but Claroc estimates that between 650 and 800 contained private material, and around 2% of the open apps held data the team rated as high or critical. Examples cited across Claroc’s write-up and coverage by The Hacker News and Cybernews include a hospital group’s staff roster covering more than 3,500 people, an ICU patient briefing, a fire department shift board and a contractor’s timesheet tool whose script exposed plaintext passwords for 18 accounts, administrators included.
Perhaps the most awkward finding for the vendor was that 24 of the exposed apps were built by SpaceXSI and X employees. They included a map of 594 strategic accounts and a confidential advertising proposal to a US federal agency. Claroc reported its findings on 8 and 9 November. SpaceXSI removed its own staff apps on 10 November, but by publication had not acted on apps belonging to other users. Beyond SpaceXSI and X, Claroc identified data from 30 other organisations, six of them in the Fortune 500. None are named.
The technical picture
No exotic exploit was involved; three ordinary design decisions stacked up.
First, the default. According to Claroc, the access step when publishing an app arrived with “Anyone with the link” already selected. SpaceXSI’s position is that apps remain private until a creator chooses to share them, and that employee accounts default to “Only you”. Claroc’s response is blunt: extra clicks offer no protection if the final setting is public.
Second, discoverability. Each Grok app gets its own hostname under a shared domain, often built from four random words that Grok suggests. That sounds unguessable, but hostnames leak into passive DNS datasets the moment anyone resolves them, and those datasets are searchable. Claroc contrasts this with chat links shared from Claude, ChatGPT and Gemini, which keep the secret token in the URL path where DNS never sees it.
Third, the code the AI writes. Claroc built two test apps with fictional data. One had no sign-in and could be edited by any visitor. The other offered “Continue with Google” or “Continue with X”, but the generated logic enrolled every signed-in user into the team before checking whether they belonged. Any Google account could read, change and delete records. The researchers stress they did not test other people’s apps this way, so whether real exposed apps share the flaw is unknown. Still, a login that authenticates without authorising breeds false confidence.
Claroc’s method was light touch: find subdomains, load each first page once, and have an AI model flag sensitive pages for manual review. It would not be hard for someone less scrupulous to repeat.
Why it matters for UK organisations
None of the affected organisations has been named as British, but treating this as an American problem would be a mistake. Grok, like a growing list of AI app builders, is a consumer-grade tool that any member of staff can sign up for with a personal or work email. Grok is simply the one that has been measured this week. Rosters, timesheets and account lists are exactly what a team lead might drop into a quick internal tool.
That is shadow IT with a new face. The app sits outside your asset register, outside your identity provider and outside any data protection impact assessment. If it holds personal data and is reachable by anyone, a UK organisation may well be looking at a personal data breach under UK GDPR, with the 72-hour clock to the ICO starting from when it becomes aware. “We didn’t know the app existed” is not a strong position when Article 32 expects appropriate technical and organisational measures, and the healthcare examples in this research show how quickly special category data can be swept up.
Your suppliers’ staff may be building these tools too, with your data in them.
Expert view
In my experience, the most damaging exposures are rarely clever. They are defaults that nobody questioned. Public cloud storage buckets taught us that lesson; it is now moving up the stack. The difference now is speed: anyone can publish a database-backed app in minutes, and the tool decides how authentication works.
The flawed sign-in logic in Claroc’s test app is the detail I would put in front of any board considering “citizen development” with AI. When we test web applications, broken access control remains one of the most common serious findings, and it usually comes from experienced developers. Expecting a large language model to get authorisation right by default, with no review, is optimistic. Generated code needs at least the scrutiny we give human-written code.
I would also push back on the vendor’s framing. Saying data is private until the user shares it is technically accurate, but secure-by-default is a design principle precisely because users click through dialogs. The NCSC has made that argument to vendors for years. Claroc’s suggested fixes, “Only you” as the default, an option restricting access to a company email domain and a warning when an app with a database has no login, are sensible and cheap.
What to do now
- Find out which AI app builders your people use. Review web proxy, DNS and CASB logs for grok.me and similar builder domains. This is the asset inventory step behind the Cyber Essentials secure configuration and access control requirements.
- Search for your own exposure. Query passive DNS and search engines for builder subdomains referencing your organisation, products or client names. Check what loads without logging in.
- Lock down or unpublish. Where apps are legitimate, set access to “Only you” or named invited users. Remove apps with no clear owner, and rotate any credentials found in their scripts.
- Assess for a reportable breach. If personal data was publicly reachable, involve your data protection officer promptly and document the decision on whether to notify the ICO.
- Set a policy, then offer a safe route. Ban unapproved publishing of business data to AI builders, but provide a sanctioned platform behind your identity provider with MFA.
- Test generated apps like any other application. Anything AI-built that handles real data should get an access control review, including attempts to log in from an account outside the organisation.
Bottom line
Nobody broke into these Grok apps: the door was left open by design. For UK organisations the risk is not this one vendor but the quiet spread of AI-built tools holding real data with nobody accountable for them. Find them, lock them down, and give staff a safer way to build.
