Check Grok App Privacy After 35,000 Were Found Open

More than 35,000 apps created with Grok were accessible without signing in, and some exposed personal information, passwords, or confidential workplace records. Anyone who has used Grok to build and publish an app should check its access setting now, especially if the app contains family, employee, customer, medical, or account data.

What happened

Security company Claroc found 37,571 Grok-built apps online, according to The Hacker News. Of those, 35,578 could be opened without an account.

Most were ordinary games, calculators, or landing pages. However, researchers estimated that about one in 10 contained internal business information or personal data. Roughly 2% of the open apps reportedly contained material serious enough to receive a high or critical rating.

The exposed information included a hospital employee directory, a briefing about an intensive-care patient, a fire department shift board, and a contractor timesheet whose code contained employee passwords in readable form. Researchers also found open apps made by staff at X and SpaceXSI; those 24 staff apps were later removed.

Grok’s chat-based builder can turn a written description into a working app. Publishing is not automatic: the creator must select Publish and choose who can open the app. In the paid account examined by the researchers, “Anyone with the link” was already selected, while the other choices were “Invited users” and “Only you.”

A hard-to-guess link is not reliable protection. Researchers said app addresses can appear in searchable DNS records after someone opens them, allowing outsiders to discover apps that were intended to be shared only with a small group.

Who is affected

The warning applies to anyone who created and published an app through Grok, including people who made tools for a household, club, school group, side business, or small office. Risk is higher when an app contains contact lists, schedules, customer records, medical details, passwords, or other information that should not be public.

The report does not say that every open app leaked sensitive information. It also does not disclose how many individual people had their data exposed or whether criminals accessed the discovered records.

What to do now

1. Review every Grok app you created. Check published apps as well as older projects you may have forgotten. Identify anything containing personal, workplace, customer, health, or account information.

2. Change the access choice. If an app does not need to be public, replace “Anyone with the link” with “Only you” or “Invited users.” Do not treat an unlisted or random-looking address as private.

3. Remove sensitive information from the app and its code. Look for passwords, contact lists, private documents, employee records, customer details, and confidential notes. The report shows that information embedded in code can be exposed along with what appears on the screen.

4. Delete apps you no longer need. Removing an unused published app reduces the chance that its address or stored data will be found later.

5. Treat exposed passwords as compromised. If an app contained a password in readable form, change that password anywhere it was used. Do not reuse the replacement on another account.

6. Test access while signed out. Open the app without signing in and confirm that a person who was not invited cannot view or change its information. In the researchers’ own test, one app’s sign-in check allowed an unrelated account to enter, view records, edit one, and delete another.