Over 94 percent of live Grok Build apps were open to anyone with the link, security research finds

A security research firm says 35,578 of 37,571 live Grok Build apps, or 94.7 percent, could be opened by anyone holding the link, with no sign-in required. The researchers say the publish panel came with the sharing option set to "anyone with the link" by default, so no intrusion was needed to view the apps' contents. Open apps included some built by the company's own staff, and exposed internal material from other organisations, among them a hospital staff roster of more than 3,500 people and an intensive care patient's lab results, according to the report. The company behind Grok said apps remain private until a creator shares them and that staff accounts default to "only you," while noting creators control sharing settings. Experts advise anyone using AI app-building tools to check the sharing setting on everything they have published. The research concerns published apps and their access settings, not proof that every private Grok chat or unpublished app was exposed. Claroc sells security products for AI-built apps, a commercial interest relevant to its findings. This report does not link to exposed apps or reproduce personal records.