Grok Build Leaves 35,000 Apps Open

This is a predictable failure of AI-built software: Grok made publishing easy while treating access control as an afterthought. Secure defaults and organization-aware authentication are core product requirements when prompts can turn sensitive business data into live apps.

• –“Anyone with the link” was selected by default in the tested publishing flow.
• –Random subdomains are discoverable through passive DNS, so link-based secrecy is not meaningful protection.
• –The tested team app authenticated users without verifying whether they were actually authorized.
• –Sensitive data included medical records, employee rosters, sales pipelines, advertising plans, and plaintext passwords.
• –AI app builders need private-by-default publishing, enterprise identity controls, role-based access, and warnings when databases lack authentication.