Thousands of applications created using the Grok AI App Builder have been found vulnerable, exposing sensitive business information and passwords to the public. This discovery highlights significant security lapses in the app building tool, allowing access to private data without any hacking attempts.
Widespread Access to Grok Applications
On November 8, 2026, researchers from Claroc identified security flaws in Grok’s app builder. They examined over 43,500 app addresses hosted on the grok.me domain and discovered that 94.7% of the 37,571 active apps were publicly accessible. Only a small fraction required user authentication.
This vulnerability stems from the use of passive DNS, a method that logs domain name queries and allows users to search them. Each Grok app receives a unique address, making them easily discoverable in these records.
Exposure of Confidential Information
Many of the apps exposed included games and calculators, yet a significant portion contained sensitive data. Examples of exposed information include hospital patient records, employee rosters, and even a fire department’s shift schedule. Alarmingly, some apps contained plain-text passwords.
SpaceXSI, Grok’s parent company, also left sensitive data unprotected, including a sales map and confidential onboarding plans. Over 30 organizations, including six Fortune 500 companies, were impacted by this data breach.
Implications and Recommendations
The incident underscores the need for stringent security measures in app development. Despite assurances from SpaceXSI that apps remain private until shared, Claroc’s findings suggest otherwise. Users of AI app builders like Grok are urged to scrutinize app access settings and secure sensitive data.
Organizations should review the tools used by their teams to ensure compliance with IT security policies. It’s crucial to test apps for unauthorized access and remove any publicly accessible data immediately.
Future Outlook and Precautions
This is not the first time Grok has faced exposure issues. In 2025, a similar breach resulted in over 370,000 shared chats appearing in Google search results. The latest breach emphasizes the ongoing need for vigilance in protecting digital assets.
To mitigate risks, security teams must stay informed of potential threats and implement robust protective measures. Continuous monitoring and timely updates are essential to safeguarding sensitive information against unauthorized access.
