More than 35,000 apps built with Grok Build could be opened by anyone on the internet, with no sign-in required, according to [research published on 10 November 2026](https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html). Some held confidential business plans, staff lists and medical information. ## How the exposure was found Security firm Claroc, in a report it calls GhostShares 2, tried 43,551 app addresses under grok.me. Of the 37,571 apps still online, 35,578, or 94.7 per cent, opened for anyone. Only 1,993 returned an access-denied error. Claroc estimates that about one in 10 of the open apps held sensitive material, and roughly 2 per cent held material it rates as high or critical, about 650 to 800 apps. ## What was inside the open apps The exposed material included a hospital group's list of more than 3,500 employees, an intensive care briefing on a single patient, and a contractor's timesheet whose code held every employee's password in plain text. Twenty-four of the open apps were built by SpaceXSI and X staff, including a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a US federal agency marked confidential. ## Why the links could be found Each Grok Build app gets its own hostname, such as four random words followed by grok.me, and those names are recorded by passive DNS services, so an unguessable-looking link did not stay hidden. SpaceXSI says apps stay private until their creator chooses to share them, and that employee accounts start set to private. Claroc reported the findings to SpaceXSI on 8 November and the remaining staff apps on 9 November. It did not reply, but took down all 24 staff apps within hours of Ars Technica asking questions.