Grok, SpaceXSI's assistant, can build a small app from a description typed into chat and publish it at its own web address. More than 35,000 of those apps could be opened with no account. Among them were 24 built by SpaceXSI's own staff, including a sales territory map of 594 accounts and advertising proposals for clients.
Why a random address still gets listed
Every published Grok app gets an address made of four random words followed by grok.me. Nobody would guess one. Nobody has to, because opening an address leaves a record.
When a person opens the address, their computer first asks a directory service where that name lives. Some companies collect those lookups and sell a searchable history of them. A customer can search that history for every name ending in grok.me. One such search returned more than 43,000 names, and about four in five of them opened an app.
It works the way it would if the post office wrote down every address it delivered to and sold the list. Your neighbours never learn the address, and it is still on the list.
What protects a link like this is where the random part sits. Shared chats from Claude, ChatGPT and Gemini keep it after the slash, and the directory never sees that part. Put it in front of the domain name, as Grok and Muse did, and it gets listed. Links with the secret after the slash can still leak in other ways: in August 2025, hundreds of thousands of shared Grok conversations showed up in Google search.
The default decides what happens next
ChatGPT also gives each published app its own address, and those are just as easy to list. The difference is the setting at publish time. ChatGPT's started on Only me, so a listed address led to an app only its owner could open. Grok's publish panel offered Only you, Invited users and Anyone with the link, and the last one was already selected.
SpaceXSI says publishing takes several clicks, and that its employees' accounts start on Only you. Even so, 24 apps built by its staff were open. Someone who builds a territory map wants four colleagues to see it. Naming each of them takes longer than pasting a link, so the link wins.
For example, a regional sales manager at a distributor could describe a map of 600 customers to an AI and have a working tool by the afternoon. She would send the link to four reps. Had the company bought software for the same job, it would have been behind the company login, and IT would have known it existed. Here nobody was asked, and the customer list became findable the first time a rep opened it.
Most of the open Grok apps were games, landing pages and calculators. About 1 in 10 held business or personal data, such as a fire department's live shift board with each firefighter's badge number, or an intensive-care briefing for one patient.
A login only helps if it checks who belongs
Asking for a sign-in is not enough either. Claroc, the security firm that found the open apps, asked Grok to build a customer list for a four-person sales team. Grok added a Continue with Google button by itself. But the code it wrote added whoever signed in to the team before checking whether they belonged, so a stranger's Google account saw every customer, changed one record and deleted another.
Lovable, Replit, Base44 and Google AI Studio also give each app its own address, so the listing problem is not limited to Grok. Any tool that does this has the same weakness, and whether it bites depends on the default.
Before an app that holds customer names, staff lists or health details goes to colleagues, set it to named people only. Then open the link in a private window, and try signing in with a personal account that is not on the list. If either one gets you in, the app is public.