The count is the solid part

Start with the number that does not depend on anyone's judgment. Claroc loaded the first page of each Grok app it found, once, from the public internet, signed in to nothing. Of the apps still online, 94.7% returned a page. That is a measurement of unauthenticated page access, repeated 37,571 times, and it is the finding the rest of the story hangs on.

It also reframes the company's defense. SpaceXSI's position, as Claroc reports its answers to a reporter, is that apps are private until the creator chooses to share, and that publishing takes several steps. Claroc agrees nothing goes public before a builder clicks Publish. Its finding is about the step after that: in the paid account it used, "Anyone with the link" was already selected when the panel opened. A preselected public-link option deserves scrutiny. But the scan does not show which setting each of those accounts was offered, who changed one, or how many of the 35,578 were public on purpose — so it cannot say how much of the exposure the preselected option caused.

The company's own staff are the sharpest example, and they should be stated carefully. Employee accounts, SpaceXSI says, start set to "Only you", so a public staff app required someone to switch the setting. Twenty-four staff apps were still open, including material marked confidential. That shows the reported employee default did not keep the company's own material in. It does not establish why each app became public, and the report does not claim to know.

"Anyone with the link" sounds contained because the links look unguessable. Grok gives each app its own hostname, usually four random words in front of grok.me. Nobody would guess one.

Nobody needs to. When a recipient opens an app, their computer asks a DNS resolver where that hostname lives. Passive DNS services collect lookups from the resolvers they run or buy data from, and let anyone with an account search them by pattern. Claroc found 43,601 names this way. Not every listed name still answers — about 6,000 of the addresses it tried were no longer online — but each name that does answer is a working link to whatever its builder published.

Claroc makes the comparison itself. ChatGPT also gives published apps their own hostnames, which passive DNS can list the same way. The difference is the starting setting: when Claroc clicked Share on a ChatGPT-built app, access was set to "Only me" until changed. A findable link to a closed app is a dead end. A findable link to an open one is an index of other people's internal tools.

The softer numbers behind the headline

The figures most likely to travel are the ones that deserve the most care. Claroc says about 1 in 10 open apps held sensitive material, and roughly 2% held material serious enough to rate high or critical. Its methodology section puts the total at roughly 650 to 800 apps with private data, based on an AI model flagging pages, hand-checking the flagged ones, and a random sample.

Those statements do not reconcile on the open-app denominator: 1 in 10 of 35,578 is about 3,600 apps, not 650 to 800. Claroc does not explain the gap, and until it does, the two figures cannot both be quoted as if they described the same set. The estimate this article uses is the narrower one — roughly 650 to 800 apps with private data, attributed to Claroc's sampling — and the 1-in-10 line is reported here so the conflict stays visible rather than being quietly resolved.

What Claroc confirmed by hand is narrower and worse per app: a hospital roster of more than 3,500 employees, a single patient's intensive care briefing, a fire department's live shift board, a contractor's timesheet with 18 passwords sitting in code every visitor's browser downloads. None of that needs a percentage to matter. And the limit of the research should be stated as plainly: open is not the same as raided. Claroc shows these apps could be found and opened. It does not show that anyone else did.

What to check if your team builds this way

The practical point is not limited to Grok. Claroc lists the same hostname pattern across AI app builders — Grok, ChatGPT, Lovable, Replit, Base44, Google AI Studio and Meta's Muse among them — and its account of how these apps go live is consistent: an internal tool published from a chat window, in minutes, by someone whose job is not security. In Claroc's description, the builder files no request and installs nothing IT would see.

Three checks follow from the report, all on your own organization's apps. Search passive DNS, or ask whoever runs yours, for your apps under the builders' domains, and open what you find signed out. Check the access setting on anything internal; on Grok it should read "Invited users" or "Only you", and a stranger should get an error page — and then test authorization with an account that should not have access, because an error page alone does not prove every data path is closed. And read the code your own apps deliver to visitors, and rotate any credential you find in it, because the timesheet's passwords were not behind the app. They were inside it, delivered to every visitor.

The fixes Claroc sent SpaceXSI include making "Only you" the default it already gives its own employees, and warning at publish time when an app holds a database and has no sign-in. Whether SpaceXSI adopts them is not known. Until the preselected setting changes, "Anyone with the link" means anyone who can search.

Sources

  1. [1] Claroc Research, "GhostShares 2: Grok Apps Exposed xAI's Business Secrets and People's Private Data", November 10, 2026Read source
  2. [2] The Hacker News, "Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords", November 2026Read source
  3. [3] SpaceXSI's position is quoted as reported by Claroc in the report above, from the company's answers to a reporter covering the research; ALFW did not receive a separate statement.