Thousands of Grok-Generated Apps Expose Sensitive Corporate Data Through Default Public Access

Security researchers at Claroc have disclosed that thousands of applications built with Grok were left publicly accessible by default, exposing sensitive corporate information from SpaceX, X, Tesla, and dozens of other organizations.

Scale of the Exposure

Claroc examined 43,551 Grok application URLs and determined that 37,571 remained online. Of these live applications, 94.7 percent could be opened without any authentication. Further analysis identified roughly 650 to 800 apps holding private data. The affected organizations include SpaceX, X, Tesla, and 30 additional companies, six of which are Fortune 500 members. Notable examples include an ICU patient dashboard displaying lab results, imaging reports, and ventilator status; a contractor timesheet application that stored 18 plaintext passwords inside accessible scripts; and a Tesla service-center scorecard revealing names, performance metrics, and bonus details for 22 technicians.

How Addresses Were Discovered

The applications were not breached through exploits. Each Grok app receives a unique subdomain in the form of random-word.grok.me. Although intended to be unguessable, these domains appear in passive DNS databases whenever users access them. Once the URLs are collected, anyone can open applications configured for “anyone with the link” access. This configuration treats obscurity as a security control rather than implementing proper authentication.

Flawed Permission Logic in Generated Code

When researchers asked Grok to build a four-person sales CRM using fictional data, the model added Google and X login options yet reversed the authorization sequence. The code added the logged-in user to the team before verifying membership, granting full access to any authenticated account. The same application allowed an uninvited Google user to view all customer records, edit entries, and delete data. Such logic errors produce no runtime exceptions and are difficult to detect without manual code review.

Default Settings Differ Between Platforms

Claroc compared the behavior with ChatGPT-generated applications. Although ChatGPT URLs are also visible in passive DNS, the platform defaults new apps to “only me” visibility. In contrast, Claroc’s paid Grok account showed the publish dialog pre-selecting “anyone with the link.” SpaceX stated that applications remain private until explicitly shared and that employee accounts default to private, yet Claroc observed the opposite default in testing.

Recommendations for Organizations

• Search passive DNS databases for unexpected Grok subdomains associated with corporate domains.
• Immediately change any application handling real data to “only specified users” permissions.
• Require human review of all AI-generated authorization logic, focusing on login flow, team membership checks, and API-level access controls.
• Enforce a policy requiring synthetic or anonymized data during development, with a final permission audit before switching to production data sources.
• Verify that unpublishing an application renders it inaccessible within seconds.

The incident underscores that AI tools accelerate both development and publication of internal applications, often bypassing traditional security gates that once prevented sensitive data from reaching the public internet.