Over 35,000 Grok Build Apps Found Publicly Accessible

Claroc researchers found that of 37,571 Grok Build apps live on the grok.me domain, 35,578 (94.7%) were accessible without login due to the default 'Anyone with the link' setting and subdomains enumerable via passive DNS.

Compiled by Sergey KostenchukPublished 2026-11-13Updated 2026-11-13

2026-11-13 Safety Google

🛡 Over 35,000 Grok Build Apps Found Publicly Accessible

Claroc researchers checked 43,551 addresses on grok.me: 37,571 apps were live, and 35,578 of them (94.7%) were accessible without login. The cause was the default 'Anyone with the link' setting and subdomains indexed by passive DNS. The leak exposed a US government agency's API key, ICU patient data, and 18 plaintext passwords; on November 8, SpaceXSI disabled 24 of its own apps.

🌍 Insecure defaults in AI app generators turn mass-produced mini-apps into an attack surface: leaks of HR data, medical records, and trade secrets, including from Fortune 500 companies.

👤 If you use Grok Build, Lovable, or Replit—check access for each app, log in with an external account, and look for passwords in the code.

Source 1: https://blog.claroc.io/ghostshares-grok-build-apps/ Source 2: https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html

Sources