More than 35,000 applications built with Grok's AI app builder could be opened without logging in, according to new security research.
Cybersecurity firm Claroc reported on November 10 that some projects contained confidential business information and personal records. The findings raise concerns about organizations relying on AI-created applications to handle internal data.
The investigation highlights two potential security gaps: applications published with publicly accessible links and inadequate access controls that can leave stored information exposed.
Confidential files and patient records surfaced in published apps
Claroc's investigation identified 24 accessible applications created by employees of SpaceXSI, formerly xAI, and X. Internal information belonging to 30 other identifiable organizations was also uncovered, including six Fortune 500 companies.
Specific findings included the following:
- SpaceXSI and X employees. Applications contained a confidential employee onboarding plan and a sales territory map covering 594 accounts. Advertising proposals were also visible, including one marked confidential for a US federal agency.
- Healthcare organizations. A hospital group's application held a searchable roster of more than 3,500 employees, while another revealed an intensive care patient's medical information.
- Contractors. One timesheet application exposed 18 employee accounts with passwords stored in plain text, including administrator credentials.
Most projects examined were ordinary games or basic utilities. Claroc estimated that approximately one in 10 contained internal business or personal information, while roughly 2% held material rated high or critical in severity.
Researchers used automated screening and manual review, but did not establish whether malicious actors had obtained the data.
Public links and weak access controls exposed security gaps
Grok's publishing feature assigns each application a grok.me address. Researchers discovered these links through passive DNS records, making them accessible to anyone who found the URLs. In Claroc's paid test account, "Anyone with the link" was preselected on the publishing screen, although creators still had to confirm publication.
Separate tests involving two researcher-created apps uncovered additional weaknesses. One lacked sign-in protections, allowing visitors to add records visible to others.
Another used Google authentication but failed to verify team membership before granting access, enabling an uninvited account to view, modify, or delete customer records. Researchers demonstrated these access control failures only in their own applications and did not alter third-party data.
Claroc notified SpaceXSI on Nov. 8 and published its findings two days later. The company said publishing requires explicit user action and employee accounts default to private access.
Researchers maintained that public sharing was preselected in their test account. All 24 staff-created applications were subsequently removed, while other users' exposed projects remained online when the report was released.
Employee-built AI tools can evade security oversight
AI app builders allow employees to publish working business tools without going through conventional software reviews. For CISOs, the resulting concern is visibility over applications that may hold confidential information without appearing in an organization's approved software inventory.
Unlike ordinary chatbot interactions, shadow AI applications can remain online and continue storing company records.
Even applications with login screens may fail to protect information if their permissions are incorrectly configured. Security teams assessing these tools need to verify whether uninvited accounts can retrieve or change records, not simply whether users can sign in.
Web application security testing can help identify such failures before employee-created software handles sensitive information.
Organizations whose records appeared in the investigation face a more immediate concern over what was publicly available and whether exposed credentials remain usable. Restricting access can prevent further disclosure, but it cannot establish whether earlier visitors obtained copies.
Without evidence of malicious exploitation, the confirmed exposure still calls for an investigation proportionate to the sensitivity of the information involved.
More cybersecurity news: Anyday Security has launched a free AI-powered platform that reportedly generated more than 200 working exploits to help organizations test their defenses.