Claroc researchers, as part of the GhostShares, Part 2 project, checked the accessibility of Grok Build mode apps and found that over 35,000 projects built on the platform were open without any login. The cause was the default publication mode "Anyone with the link" plus predictable subdomains, which can be listed via passive DNS without name guessing. Confidential materials from 30 organizations, including six Fortune 500 companies, were publicly available: from commercial proposals to medical records. The incident showed that creating apps with a single prompt still lacks secure defaults, so such projects must be checked as strictly as regular production code.

image
image
image

What happened

The Claroc team collected 43,551 subdomain addresses of the form .grok.me and checked them over HTTP without authentication: 37,571 apps were found on the network, and 35,578 of them — 94.7% — opened fully without login. Among the projects open to outsiders, researchers described a sales map with 594 accounts, a confidential commercial proposal for a US federal agency, a hospital staff list of 3,500 or more people, and data from an intensive care unit patient, including test results and mechanical ventilation parameters. In the client script of a time-tracking app, 18 accounts with plaintext passwords were found. Twenty-four apps created by X and SpaceXSI employees — the company that develops Grok itself — were also public. The defect was not limited to publication: according to Claroc, an account attached to a chat was added to the app's "team" before the code checked whether the account belonged to that team, so in the researchers' own test build for the sales department, an uninvited account could view and modify client data. On November 8, SpaceXSI disabled its 24 apps, and on November 10, Claroc began independently notifying affected organizations.

Context

Grok Build is a Grok mode where an app is built directly from a dialogue: the user describes the task with a prompt, the model generates the project, and publication is reduced to issuing a link. The "prompt — app — link publication" loop became the main scenario for the AI builder category precisely because it requires no programming or environment setup, but along with simplicity, it shifted key engineering decisions — access settings, authorization model, secret storage — to platform defaults. The second factor is addressing: each app has a unique subdomain of the form .grok.me, and all requests to such subdomains end up in passive DNS, i.e., in DNS query records collected by third-party services, so existing names can be listed without a single guessing attempt on the site itself. From these two circumstances, the main point for the category follows: mini-apps from builders work well as demonstrations, but by default are not ready for production with real data — not because the model writes bad code, but because the publication point itself is designed around speed, not access control.

Why this matters for the industry

For the industry, this is not a one-off failure, but the first systematic measurement of risks in app generators: an insecure default publication mode, broken permission checks, and predictable addressing turn tens of thousands of automatically created mini-apps into a ready-made attack surface through which HR data, medical records, and trade secrets of large companies leak. Claroc's methodology — subdomain enumeration via passive DNS plus accessibility check without authentication — is reproducible, and the same audit will likely be applied to Lovable, Replit, and other builders. Expected platform response: private publication by default, an explicit publication step with audience selection, server-side permission checks as a generation template, moving secrets out of client code, and enterprise-level restrictions. Against this backdrop, a ready niche appears in the market: a security layer and scanners specifically for AI-generated apps, security assessment of generated projects, and the first enterprise plans. Within a two-year horizon, "secure by default" will likely become a competitive feature of platforms, and the category itself will split into consumer toys and solutions ready for enterprise requirements with built-in ACL, audit, and SSO; for now, the incident hits trust in the category, and deals involving vibe-coding will now run into security questions.

Why this matters for users

Practical takeaway for the reader: if you or your company used Grok Build, Lovable, Replit, or similar builders, consider every built app public until you verify otherwise. It is worth reviewing the access settings of each app and switching all projects with real data to private mode; log in with an external personal account and ensure that the visible part does not open; then search for hardcoded passwords and API keys in the client code. A separate lesson for those who generate code themselves: authentication is not authorization — "login with Google" only confirms identity, but you need to check the user's permissions for a specific resource, and do so on the server, not in the client. If a built app stores client or employee data, standard requirements for production systems should be applied to it, regardless of whether the project was written by a human in a week or generated in a minute.

What is still unknown / limitations

Methodologically, Claroc measured only the Grok Build platform and the grok.me domain, so the conclusion about the systemic nature of the problem for all AI builders, including Lovable and Replit, is a plausible but not yet measurement-confirmed extrapolation, and the same procedure is needed on each platform for verification. A direct contradiction in the materials is also unresolved: SpaceXSI stated that projects remain private before publication and employees have the private option set by default, while 24 apps by X and SpaceXSI employees were open; these two statements cannot be true simultaneously, and an explanation for the discrepancy has not yet been published. It remains unknown how long the open projects were available before the research, whether anyone external accessed their data before the apps were disabled, and when all 30 affected organizations will receive notifications, as Claroc only began the mailing on November 10.

Sources

Author

Look at AI, editorial team