Grok Build’s App Sharing Puts Private Data at Risk, Researchers Say

Grok-built apps exposed company information and personal data to outsiders, according to security firm Claroc, whose November 10 research raises questions about how easily AI-generated tools become public.

Claroc says 35,578 apps opened without sign-in, although most were ordinary games, calculators and websites. It estimates 650 to 800 contained private data. Twenty-four belonged to SpaceXSI and X staff, including sales material, and were taken down after disclosure, the researchers say.

The warning arrives as Grok expands its software-building tools. Its Agent Dashboard, introduced October 1, brought multiple coding agents into one interface, with parallel tasks and separate Git worktrees. That dashboard focuses on coordinating development work; Claroc examined apps published from Grok’s chat-based Build mode.

These tools can help teams move from an idea to working software faster. But a finished interface and a functioning login screen answer different questions from who should be allowed to see the underlying information. For businesses adopting AI-built tools, reviewing access deserves its own place in the rollout.

Claroc says its paid account preselected “Anyone with the link” during publishing. Apps did not go public automatically: creators still had to publish them. The firm also found faulty team-access checks in its own test app, not by modifying other users’ apps.

According to Claroc, SpaceXSI told a reporter that publishing requires several steps and employee accounts default to “Only you.” Claroc reproduced that response in its report.

The firm’s report recommends private-by-default sharing and organization-based access. Its tests found that selecting “Only you” successfully blocked outsiders.

Would you trust an AI-built app with company data before someone checks its sharing settings?