Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords

What happened?

Researchers found that apps built with Grok’s app builder are open to Anyone online. Thousands of these apps hold private business data, staff details, plain-text passwords, and patient information. No hacking was needed to reach them. Grok’s Build mode creates and publishes chat-generated apps under grok.me, while its parent company, SpaceXSI (formerly xAI), did not respond to Claroc but answered media questions on November 10, 2026. On November 8, 2026, Claroc researchers worked through a list of more than 43,500 grok.me addresses.