35,000 Grok-Built Apps Were Left Unlocked, Exposing Patient Details, Plain-Text Passwords and Even Its Maker's Own Confidential Files

Building an app by just describing it to an AI has become routine for a lot of office workers. A security firm now says that convenience came with a big hole: more than 35,000 apps made with Grok could be opened by anyone, and some held internal company files, staff lists and even patient information.

What happened

According to The Hacker News, security company Claroc found 37,571 Grok-built apps online, and 35,578 of them opened without any sign-in. Most were games, landing pages and calculators, but the researchers estimate about 1 in 10 contained internal business or personal data, and roughly 2% held material serious enough to rate as high or critical.

The exposed material included a hospital group's searchable list of more than 3,500 employees, an intensive-care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet whose code held every employee's password in plain text.

In an ironic twist, 24 of the open apps were built by staff at X and at SpaceXSI, the company that makes Grok and was formerly known as xAI. They included an onboarding plan for a new sales hire marked confidential, a sales territory map covering 594 accounts, and an X advertising proposal to a U.S. federal agency, also marked confidential. The researchers say the company took down those 24 staff apps after their report, but not other users' open apps.

A few terms

Vibe coding: describing what you want in plain language and letting an AI build the working app, with no hand-written code.

Passive DNS: whenever someone visits a web address, their computer first asks which server it points to. Some services record those lookups and let subscribers search them.

What went wrong

Every published Grok app gets its own subdomain under grok.me, and Grok suggests four random words as the name so nobody can guess it. But the researchers point out that once anyone opens an app, that name lands in passive DNS records, which anyone with an account can search by pattern. A hard-to-guess name stops protecting you once it sits in a searchable list.

In the paid account the researchers used, the "Anyone with the link" access option was already selected when they went to publish. By comparison, when they shared an app from ChatGPT's app builder, it defaulted to "Only me."

The code the AI wrote raised its own alarm. The researchers built two test apps with made-up data. One, a contact list, got a database but no sign-in at all, so a stranger in a private browser window could add a row. The other, a customer list for a four-person sales team, got "Continue with Google" and "Continue with X" buttons that Grok added on its own. But the generated code added each person who signed in to the team before checking whether they belonged, so the check always passed. An uninvited Google account got in, viewed every customer, edited one record and deleted another. The researchers stress they ran these tests only on their own apps.

What the company says

As relayed by The Hacker News, the company said Grok apps stay private until their creators share them, that publishing takes several steps including a choice between "Only you" and "Anyone with the link" plus a legal disclaimer, and that employee accounts default to "Only you." According to The Verge, Grok said in a post that an Ars Technica report on the findings was "incorrect," saying the issue involved the app builder feature on grok.com, not Grok Build, and that users review sharing settings and a warning before publishing. The Hacker News notes that the chat-based app builder shares the Grok Build name with a separate terminal coding tool.

The researchers have started emailing affected organizations themselves. They asked the company to make "Only you" the default and add an option limiting an app to a company's own email domain. In October, the same team found a similar problem with pages shared from Meta's Muse agent; Meta disabled sharing and then shipped a fix.

Why it matters

AI has made "anyone can build an app" real, but most of the people doing it aren't engineers. They may not grasp the difference between sharing a link and going public, and they can't tell whether AI-written login code actually works. A sales team that once would have gone through IT and put a tool behind company sign-in can now have one live on the open internet in minutes. This case suggests that the default settings and auto-generated security code in AI app builders are becoming a new gap in corporate data protection. Nor is it only Grok: the researchers say builders such as Lovable and Replit also give each app its own web address.

What it means for you

If you've used AI to build a small tool, tracker or web app at work, check it now: Is sharing set to "Anyone with the link"? Can someone outside your company sign in? Does the code contain names, emails or passwords? Take down apps you no longer use. For everyone else, it's a reminder that your medical records, employee ID or contact details could be sitting in an app a coworker whipped up with AI, and that when AI tools come into the office, security rules need to come with them.

Original sources published: The Hacker News, Nov. 11, 2026, 20:19 Beijing time (UTC+8); The Verge, Nov. 12, 2026, 04:54 Beijing time