{"slug": "claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link", "title": "Claroc finds 35,578 Grok Build apps open to anyone with a link", "summary": "Claroc Research reported on November 10, 2026 that 35,578 of the 37,571 live apps it found on SpaceXSI's Grok Build platform — approximately 94.7% — could be opened without signing in, after testing 43,551 addresses on the grok.me domain between November 8 and 10, 2026. Claroc said 24 of the open apps were built by SpaceXSI and its employees and held confidential internal material, including sales territory maps and onboarding documents prepared for a US federal agency, while data tied to 30 additional organizations, including six Fortune 500 companies, appeared in publicly reachable apps. SpaceXSI removed the 24 staff-built apps but had not addressed the broader population of open user apps as of the report, which attributed the exposure to Grok Build's link-sharing feature and a lack of organization-level access management.", "body_md": "# Claroc finds 35,578 Grok Build apps open to anyone with a link\n\nA security review of SpaceXSI's app platform found most live apps required no sign-in, including 24 built by the company's own staff\n\nSpaceX’s AI division built a tool that lets people spin up apps fast. According to Claroc Research, it also left nearly all of those apps open to anyone holding a link.\n\nIn a report published November 10, 2026, Claroc said 35,578 of the 37,571 live apps it found on SpaceXSI’s Grok Build platform could be opened without signing in. That works out to approximately 94.7%, which is less a leak than a default setting.\n\n## What Claroc found\n\nClaroc tested 43,551 addresses on the grok.me domain. Of those, 37,571 were live during the testing window of November 8 to 10, 2026.\n\nThe culprit, per the report, is Grok Build’s link-sharing feature. Each app gets a randomized identifier on grok.me. Anyone who has the link can walk right in, no login needed.\n\nThe most awkward detail involves SpaceXSI itself. Claroc said 24 of the open apps were built by the company and its employees.\n\nThose staff apps reportedly held confidential internal material. The report points to sales territory maps and onboarding documents prepared for a US federal agency.\n\n## Beyond SpaceXSI’s own house\n\nThe exposure was not limited to SpaceXSI employees. Claroc said it found data tied to 30 additional organizations sitting in publicly reachable apps.\n\nThat group included 26 organizations with more than 1,000 employees. Six were Fortune 500 companies.\n\nThe types of data described in the findings include hospital staff rosters and sensitive patient records.\n\n### AI, tech, and the markets they move—in one daily briefing.\n\nDaily. Free. Join 34,000+ readers across crypto, finance, and policy.\n\nClaroc also flagged employee timesheets that contained passwords stored in plaintext.\n\nMost of the 35,578 open apps were not necessarily dangerous on their own. Estimates put the number holding potentially sensitive information at between 650 and 800.\n\n## How SpaceXSI responded\n\nClaroc said it began reporting the problems on November 8, 2026, two days before going public.\n\nAccording to the research findings, SpaceXSI removed the 24 apps built by its own staff. The broader population of open user apps had not been addressed as of the report.\n\n## Background: a young platform scaling fast\n\nGrok Build opened to broader availability in August 2026. That means the platform went from wider launch to tens of thousands of live apps in roughly three months.\n\nThe research describes the core weakness as a lack of organization-level access management. Put simply, there was no easy way for a company to say only its own people should see its apps.\n\n## What this means\n\nFor businesses using AI app builders, the lesson is uncomfortable but useful. A hard-to-guess link is not the same thing as a login.\n\nRandomized identifiers can slow casual snooping. They do not stop someone who systematically checks addresses, as Claroc’s test of 43,551 grok.me addresses showed.\n\nThe healthcare angle raises the stakes. Patient records and hospital rosters appearing in openly reachable apps could create regulatory headaches for the organizations that built them, separate from any issue with the platform.\n\nThe federal agency link adds another layer. Onboarding material intended for a US government body showing up in an open app is the kind of detail that tends to draw questions from procurement and security teams.\n\nFor SpaceXSI, the pressure point is the gap between its response and the size of the problem. Pulling 24 staff apps addresses its own exposure, while thousands of customer apps remained open per the findings.\n\nWhat to watch next: whether SpaceXSI changes Grok Build’s default sharing behavior, adds organization-level controls, or notifies the companies whose data appeared in open apps.\n\nAlso worth watching is whether any of the 30 named organizations, including the six Fortune 500 firms, respond publicly. For now, the clearest fix sits with users themselves: anyone who built a Grok Build app with sensitive data may want to check who can actually open it.\n\n**Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).", "url": "https://wpnews.pro/news/claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link", "canonical_source": "https://cryptobriefing.com/claroc-grok-build-apps-exposed-online/", "published_at": "2026-11-11 11:04:15+00:00", "updated_at": "2026-11-11 11:19:43.251312+00:00", "lang": "en", "topics": ["ai-safety", "ai-products", "ai-tools", "artificial-intelligence"], "entities": ["Claroc Research", "SpaceXSI", "Grok Build", "grok.me"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link", "markdown": "https://wpnews.pro/news/claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link.md", "text": "https://wpnews.pro/news/claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link.txt", "jsonld": "https://wpnews.pro/news/claroc-finds-35578-grok-build-apps-open-to-anyone-with-a-link.jsonld"}}