Grok Build deployments made generated applications and embedded organizational data discoverable

Claroc surveyed Grok Build hosted app subdomains using passive DNS and found 35,578 of 37,571 currently online applications readable without a sign-in challenge. A smaller reviewed sample included company, employee and health-related materials exposed through author-published apps.

Publishing was a user action; a link-shareable setting appeared selected by default in a controlled test. A separate team-app test accepted unrelated Google or X OAuth users into a shared team before checking membership, exposing or permitting changes to that test app's client records. Generated frontends inherit the publication defaults and authorization logic chosen by the app generator and operator. A long, unadvertised subdomain is not an access control because certificate and DNS observations make it discoverable.

The estimate of 650 to 800 sensitive apps is not a verified affected organization count; the controlled OAuth bypass is not a measured prevalence rate, and no criminal exploitation or bulk patient-data theft has been confirmed. Audit published app configuration, test server-side team enrollment, and remove actual secrets and sensitive documents from public builds.

Evidence reconciliation and effect boundary. Public deployment and generated-app authorization failed in different ways. The large passive-DNS survey counted reachable, apparently public hosts, while the team-app experiment showed how a legitimate OAuth login could be mistakenly treated as authorization for team data. The latter was reproduced on the researcher’s own generated app and cannot be assigned as a prevalence rate to the 35,578 public hosts. Sensitive examples require careful treatment, since a publicly accessible record is exposure rather than proof of prior criminal extraction.