35,578 Grok apps opened without sign-in, Claroc finds

By Olivia Hart

Claroc Research reported on November 10, 2026, that 35,578 of 37,571 Grok apps, still online when tested, opened without sign-in. The result covered more than nine in 10 apps tested, including 24 built by SpaceXSI and X staff, according to Claroc’s GhostShares research.

What did the research uncover?

Claroc said the open apps contained confidential corporate, employee and personal material. Claroc said people create the apps by describing them in chat and publish them from the same chat window; a report screenshot showed Grok’s Build mode selected.

Claroc said the remaining 1,993 apps returned HTTP 401 errors linked to the “Only you” or “Invited users” settings. Claroc’s 35,578-app figure measures public visibility, not 35,578 confirmed data breaches; the research group separately estimated that 650 to 800 apps contained private data. Claroc’s findings put access settings at the center of the exposure.

How did Claroc discover the apps?

Claroc identified 43,601 names under grok.me through common subdomain-discovery techniques. Researchers loaded each tested app’s first page once from the public internet without signing in, then reviewed saved copies offline.

Claroc said each published app receives its own <name>.grok.me hostname. DNS lookups can feed searchable passive-DNS indexes, so even addresses built from four random words can become searchable after use.

Claroc said shared links put the random identifier in the URL path, so DNS did not expose it. Claroc warned that search indexing and link scanners could still reveal it. Claroc’s research shows that public hostnames made the apps easy to enumerate.

What did the open apps expose?

Claroc found a confidential enterprise-sales onboarding plan among staff apps at SpaceXSI, formerly xAI, and X. The apps also included a territory map covering 594 strategic accounts and their pipeline, plus eight X advertising proposals, media plans and decks.

Claroc said one advertising proposal was addressed to a US federal agency and marked confidential. A separate advertiser account board tracked progress toward a $1.6 million sales goal.

Beyond SpaceXSI and X, Claroc identified internal data from 30 organizations. Twenty-six had more than 1,000 employees, and six were Fortune 500 companies.

Claroc said most open apps were games, landing pages and calculators. It estimated that 650 to 800 apps contained private data after using an AI model to flag candidates, manually reviewing flagged pages and checking the model against a random sample.

Claroc’s manually confirmed examples included a hospital group’s searchable roster of more than 3,500 employees, an intensive-care briefing with one patient’s labs, imaging and ventilator status, and a fire department’s live shift board with firefighters’ names and badge numbers. Claroc described these examples as manually confirmed after AI-assisted screening.

Among the confirmed examples, a contractor’s timesheet exposed 18 employee account records with plaintext passwords, including administrator accounts, in script code downloaded by visitors’ browsers. Claroc’s confirmed examples centered on staff plans, patient information and employee credentials, even though games and basic web tools made up most open apps.

Could the publishing controls prevent data changes?

Claroc built two apps with made-up data to test write access and authorization. In its paid account, nothing became public before the builder clicked Publish, but the access panel then preselected “Anyone with the link” alongside “Invited users” and “Only you.”

The first app was a contact list with a database and no sign-in. A record added from a signed-out incognito window appeared for the next visitor.

The second was a customer list intended for a four-person sales team. Grok added Google and X sign-in buttons, but its code enrolled each signer as a team member before checking membership, so the check passed.

An uninvited Google account viewed every customer, changed one record and deleted another, according to Claroc. Claroc demonstrated those write and authorization failures only in its own apps; it did not sign in to, submit forms to, call server functions on or modify anyone else’s app.

Claroc said an open app may also permit changes if it lacks sign-in or verifies identity without verifying team membership. Claroc also showed that available controls worked when enabled.

With “Only you” selected, the first app returned HTTP 401 to a stranger for both its page and data function; unpublishing the second app took its address offline within seconds. Claroc’s tests showed that Grok’s controls could block access, but generated authentication code did not reliably enforce team membership.

What changed after SpaceXSI was notified?

Claroc said it notified SpaceXSI on November 8, 2026, about the onboarding plan and an advertising proposal. It supplied exposure counts, the two test apps and four proposed fixes, then reported the other staff apps on November 9.

At publication, SpaceXSI had answered a reporter’s questions but had not replied directly to the research report. Staff apps were taken down after the report, while exposed apps belonging to other users remained online.

SpaceXSI told the reporter: “Apps remain private until creators choose to share them.” The company also said publishing requires several steps and employee accounts default to “Only you.” Claroc’s finding concerned the access choice in an ordinary paid account, where “Anyone with the link” was preselected.

Claroc said the staff apps remained public despite the employee default. It proposed hard-to-guess paths under one host, organization-domain-restricted sharing, a default of “Only you” with access choices shown before publication, and warnings for database-backed apps without sign-in, including invite-list generation for team requests.

Because SpaceXSI’s response did not say it would notify app owners, Claroc began contacting affected organizations itself. Three organizations had been emailed by publication. The public report omitted hostnames, app titles and links, and Claroc said saved copies would be deleted after notifications finished.

Claroc’s proposals target the main failure modes, but they remain proposals until SpaceXSI implements and retests them. SpaceXSI’s next test is whether it enforces “Only you” before publication and preserves team checks after sign-in; at publication, exposed apps owned by other users remained online.