As reported by The Hacker News, security firm Claroc has uncovered that over 35,000 apps built with Grok's AI app builder were publicly accessible, with approximately 2% containing high or critical severity data — including plaintext employee passwords, patient ICU briefings, and confidential federal advertising proposals. The findings expose a deeper problem than any single misconfiguration: AI-assisted app generation platforms are creating data exposure at scale, and the default access models of these tools are actively working against defenders.

AI Security Alert: As reported by The Hacker News, security firm Claroc has uncovered that over 35,000 apps built with Grok's AI app builder were publicly accessible, with approximately 2% containing high or critical severity data — including plaintext employee passwords, patient ICU briefings, and confidential federal advertising proposals.

The Real Problem: Defaults That Invite Exposure

The Claroc research highlights that Grok Build's default access setting — "Anyone with the link" — is selected by the platform before users even reach the publish step. This is not a misconfiguration by careless users; it is a design choice by the platform. Compare this to ChatGPT's app builder, which defaults to "Only me" until the creator explicitly changes permissions. The difference between these two defaults represents the difference between thousands of leaked apps and thousands of private ones.

The article notes that roughly half of discovered app names followed Grok's suggested four-random-word naming pattern. The implication is that these names are "hard to guess" — but this is security through obscurity, and it fails for a simple reason: passive DNS records subdomain lookups and make obscure URLs discoverable. Any app that has been visited by anyone, anywhere, is indexed in passive DNS datasets that are searchable by anyone with an account to services like SecurityTrails, RiskIQ, or Censys. Obscurity is not access control.

The core issue is not that users are making poor choices — it is that the platform's default is the insecure choice, and the secure choice requires additional effort. In security UX, the path of least resistance always wins.

Who Is Affected and Why This Matters

The exposed apps span construction, energy, healthcare, defense, and at least six Fortune 500 companies. The data types — ICU patient briefings, fire department live shift boards, plaintext password timesheets — represent violations of HIPAA, potential PHI exposure, and basic operational security failures. The 24 apps traced to X and SpaceXSI staff, including a confidential federal advertising proposal, demonstrate that even the platform's own employees fell into the same trap.

This is not a fringe problem. Grok Build was opened to every Grok plan on August 19, 2026. Every employee with a Grok subscription can now generate and publish a functional web app in minutes — and if they accept the default, that app is world-accessible within a DNS-searchable namespace. The attack surface implications are staggering: a single well-intentioned HR employee building an onboarding tracker could expose an entire org chart, a salesperson's territory map could leak 594 account names, and a contractor's timesheet could hand over plaintext credentials for an entire workforce.

Broader Implications: AI App Builders as Shadow IT

This research signals the arrival of a new category of shadow IT. Traditional shadow IT involved employees signing up for unsanctioned SaaS tools. AI app builders represent something worse: employees creating custom applications that process and store organizational data outside any governance framework. There is no DLP policy, no access review, no data classification, and no inventory. The apps exist on a third-party domain, governed by a terms-of-service agreement that most users never read.

For CISOs, this means that the traditional perimeter — already porous — now has thousands of micro-perimeters you cannot see, each potentially housing sensitive data, each discoverable through passive DNS. The question is not whether your employees are using these tools. The question is how many apps they have already published and what data those apps contain.

Shield53 Recommendations

Shield53 Recommendations
Immediate: Search passive DNS datasets (SecurityTrails, Censys, RiskIQ) for *.grok.me subdomains associated with your organization's email domains or known employee usernames. Document every hit.
Governance: Add AI app builder platforms (Grok Build, ChatGPT apps, Claude Artifacts, v0, Bolt) to your acceptable use policy. Require that any business data be processed only in sanctioned, enterprise-tier instances with SSO and administrative controls.
DLP: Deploy outbound DLP rules that detect sensitive data patterns (SSNs, PHI, API keys, credential formats) in content being pasted into AI tooling. Browser-based DLP extensions can catch this before data leaves the corporate network.
DNS Monitoring: Set up continuous monitoring for new subdomains on AI platform domains (grok.me, chatgpt.com, v0.dev, bolt.new) originating from corporate IP ranges or through recursive DNS logs.
Vendor Pressure: Demand that AI platform vendors default to least-privilege access ("Only me") rather than "Anyone with the link." The burden should be on openness, not on privacy. Until vendors fix this, every AI-generated app is a potential breach waiting in passive DNS.
Incident Readiness: If your organization is identified in the Claroc dataset or similar research, treat it as a confirmed data exposure incident. Initiate credential rotation for any plaintext passwords found, notify affected individuals per HIPAA/GDPR requirements, and conduct a full audit of AI tool usage across the workforce.

The Claroc findings are a preview of a larger wave. As AI app builders proliferate across consumer and enterprise tiers, the volume of inadvertently exposed data will only grow. The fix is not better guessing on subdomain names — it is better defaults, better governance, and better visibility into the AI tools your workforce is already using.