Security firm Claroc found 37,571 apps built with Grok’s app builder, and 35,578 of them were open to anyone without a sign-in, The Hacker News reports. Most were games, landing pages and calculators, but about 1 in 10 held internal business or personal data, and Claroc estimates roughly 2% were serious enough to rate high or critical. That included credentials and other secrets in some apps.
Twenty-four of the open apps were built by staff at X and at SpaceXSI, the company behind Grok (formerly xAI). SpaceXSI has since taken those staff apps down, but not other users’ apps. Claroc also found internal data from dozens of other organizations.
Grok can turn a chat prompt into a published app, a feature opened to every Grok plan on August 19. Each app gets its own site, and the creator chooses who can open it. In Claroc’s tests on apps they built themselves, an “anyone with the link” setting was enough to leave data hanging out.
What to do
If you published a Grok-built app, review its sharing settings now. If it was reachable without a sign-in and might have held secrets, take it offline and rotate those credentials. Don’t put API keys, passwords or internal data in an app you share by link.
God Bless, and Happy hacking!
