Grok Left The Door Open

The real news

The story, straight

Grok Build turns typed instructions into working apps. Publishing puts an app online; its access setting decides whether strangers can open it.

A difficult-to-guess address is not the same as a locked door.

Claroc found that 35,578 of 37,571 Grok-built apps still online opened without sign-in: 94.7%. That percentage describes the live apps tested, not every Grok app.

In Claroc's tested paid account, the publish panel had 'Anyone with the link' preselected. App names appeared in searchable address-lookup records: when a browser finds the server behind an address, services can record that lookup.

Random words cannot keep an entrance secret once its address enters a directory.

Nothing required breaking in. The joke is a security guard holding the door open, then congratulating himself because nobody forced it.

Claroc estimates 650–800 open apps held private data. Its findings included 24 apps built by SpaceXSI and X staff; those were taken down.

That does not establish a wider product fix.

SpaceXSI says apps stay private until creators share them, publishing requires several steps including a legal notice, and employee accounts default to 'Only you'. Claroc sells tools for securing AI-built apps, so these findings are attributed research, not an independent audit.

For private work, select 'Invited users' or 'Only you', then check that a stranger cannot enter. Hire a lock, not a secret address.

Sources: Ars Technica; The Hacker News; The Decoder.

Repost if your security requirements include the door actually closing.

Thanks for supporting Lil'meme. Your support is appreciated.