Security firm Claroc found 37,571 apps built with Grok’s chat-builder feature on the open internet, and 35,578 of them required no sign-in. Some of the open apps leaked internal staff and customer data, including apps built by employees at X and SpaceXSI, formerly xAI.
What Claroc Counted Among Grok-Built Apps
Claroc published its report on November 10, and The Hacker News covered it on November 11. Of the 37,571 apps, 35,578 were open without a sign-in. The count includes 24 apps built by staff at X and SpaceXSI.
How Much of the Open Data Was Sensitive
About one in 10 of the open apps held internal business or personal data. Roughly 2 percent were rated high or critical in severity.
Examples of Exposed Internal Material
Claroc’s findings span corporate, government-facing and health-related content.
X and SpaceXSI Staff Apps
The staff-built apps exposed a confidential sales onboarding plan, a 594-account sales territory map and a confidential X advertising proposal addressed to a U.S. federal agency. X and SpaceXSI have since taken those 24 apps down.
Hospital, ICU and Fire Department Data Exposed
Among the exposures, a hospital group’s list included more than 3,500 employees. An ICU patient briefing and a fire department shift board also appeared in open apps. A timesheet app stored employee passwords in plain text.
Thirty Other Organizations Affected by Grok App Exposure
Claroc found internal data from 30 other organizations beyond X and SpaceXSI. Twenty-six of them have more than 1,000 employees, and six are Fortune 500 companies. The report does not name those organizations.
Feature Availability and Current Status
The chat-builder feature opened to all Grok plans on August 19. The staff apps from X and SpaceXSI were removed, but the other users’ apps remain online, according to the report.
Scale of the Open Exposure
The proportion of open apps that held sensitive data is a minority, but the absolute numbers are large. With 35,578 apps requiring no sign-in, one in 10 holding internal business or personal data implies thousands of exposed apps, though Claroc’s report as relayed by The Hacker News does not give a precise number for that group. The 2 percent rated high or critical covers the most sensitive material, such as the patient briefing and the plaintext passwords.
The incident places responsibility in a gray area. The apps were built by users, not by the platform operator, and the exposure arises from apps being left reachable without a sign-in requirement. The report does not say whether Grok’s tooling defaults to public visibility, whether Grok’s maker has responded beyond the staff app removals or what notices went to the affected organizations.
The Hacker News is the only source fetched for the story. The report shows the kind of material that employees put into AI app builders, from sales plans to health records, and the speed at which those apps became publicly discoverable after the feature opened to all plans in August.
Sources and Limits of Claroc’s Findings
The Hacker News covered Claroc’s November 10 report on November 11. The reporting does not identify the 30 other organizations or the Fortune 500 companies among them, and it does not say whether Claroc notified the affected parties. The 24 staff apps from X and SpaceXSI are the only ones confirmed taken down.
Claroc’s ratings split the open apps into tiers. About 10 percent held internal business or personal data, and roughly 2 percent rated high or critical. The examples the report lists, including the hospital group’s staff list and the plaintext-password timesheet app, come from the more sensitive end of that distribution.
The report’s timing links the exposure to a product change: the feature opened to all Grok plans on August 19, and Claroc’s count came less than three months later.
