Asaf Aprozper and his colleagues at Claroc spent Nov. 8 opening web addresses. They had a list of 43,601 hostnames under grok.me, the domain where Grok publishes the applications people build with its chat-based app maker. They loaded the first screen of each app once, from the public internet, signed in to nothing, and saved what came back. Nobody had sent them a single link.
Of the 37,571 apps still online that day, 35,578 opened for anyone, or 94.7% of the total, Claroc said in a report this week. Only 1,993 answered with the 401 error that a restricted app returns. The researchers assembled the list with standard subdomain discovery, which means nobody guessed and nobody asked.
What sat behind those open doors was not mostly games and calculators, though most of the apps were exactly that. About one in ten held internal business or personal material: a hospital group’s searchable staff roster with more than 3,500 names, an intensive care briefing on a single patient with lab results and ventilator status, a fire department’s live shift board, and a contractor’s timesheet whose code carried 18 passwords in plain text, administrator credentials among them.
The mechanism was two design decisions, neither of them a bug in the conventional sense. Each published app gets its own hostname of the form name.grok.me, and every visit to that hostname produces a DNS lookup that commercial passive-DNS services record and index. The address is the secret. Once it sits in a searchable database, and Claroc says such services offer pattern queries to paying customers, there is no secret left to guess.
The second decision is the default. When a creator clicks Publish, the access panel offers “Anyone with the link,” “Invited users” and “Only you,” with the first preselected. The controls work: Claroc changed the setting on its own test apps and strangers immediately received an error. The problem is what most people leave alone.
That the company’s own staff left it alone is the detail that makes the story travel. Twenty-four of the open apps had been built by employees of SpaceXSI, the company formerly known as xAI, and of X. Among them were a confidential onboarding plan for a new enterprise sales hire, a sales territory map covering 594 accounts, and advertising proposals prepared for a U.S. federal agency and marked confidential. A reporter’s email on Monday evening was followed within hours by the removal of all 24, while apps built by other users stayed up.
SpaceXSI said apps remain private until their creators choose to share them, that publishing takes several steps and ends with a legal disclaimer, and that employee accounts default to “Only you.” Claroc agreed that nothing goes live before the user clicks Publish, and said the preselected option at that moment is the flaw. It asked the company to serve shared apps on hard-to-guess paths under a single host and to make “Only you” the default.
A second flaw appeared in an app Grok built for the researchers themselves. When they asked for a team app with a customer list, the generated code added “Continue with Google” and “Continue with X” buttons and enrolled each signed-in user in the team before checking whether the user belonged to it, so the check always passed. Claroc tested this only on its own app and did not attempt to exploit anyone else’s.
The pattern is not new, and Claroc is the firm that named it last month. In October it published a similar study of Meta’s Muse agent, listing more than 6,800 share hostnames in a commercial passive-DNS dataset. Meta paused sharing and reissued items at new addresses. The recurrence across two vendors in five weeks suggests a category problem rather than one company’s mistake, which is what the researchers argue.
Why it keeps happening is structural. These builders are meant to be used without IT. An employee with a browser and a company Google account can produce a working internal tool in an afternoon, and the tool inherits whatever the platform sets as default. The feature that makes the product spread makes it invisible to the people whose job is to inventory systems holding patient records and payroll data.
The exposure also cuts against what software procurement has taught companies for twenty years. A purchased tool arrives with a contract, a security review and a login wall. A generated one arrives with a URL and a share button, and its author may not think of it as software at all. Claroc’s advice to security teams is correspondingly plain: find out which builders your staff use, look up those domains in passive DNS, and check whether a stranger gets an error page.
There is a commercial interest to weigh. Claroc sells tools that find and fix apps built with AI, and its report is also a product demonstration. The numbers are reproducible and the company published its method, which is more than most vulnerability disclosures offer, but readers should know who is counting.
The 24 staff apps are down. The rest are not, and Claroc said it was still notifying the organizations it could identify, among them 30 companies, 26 with more than a thousand employees and six in the Fortune 500. Whether the affected hospitals, contractors and agencies treat what happened as a breach with notification duties, or as a misconfiguration that stayed inside the family, is a question each will answer with its own counsel.
The open question is whether the default survives the attention. A platform can change a preselected radio button in a week. It is harder to change the assumption underneath it, which is that a link nobody shared is a link nobody has.
