Grok code leaks and security flaws in 2026

35,578 Grok-built apps open to anyone, Grok Build uploading whole code repositories, an unpatched Grok Bot sandbox flaw: what happened and what to do.

In short: security researchers found 35,578 apps built with Grok open to anyone on the web, including 24 made by SpaceXSI and X staff (reported November 10, 2026) · a researcher reported on November 8 that a chain of flaws in Grok Bot's cloud sandbox can hand an attacker the whole account, and says it is still unfixed · in July, the Grok Build coding tool was caught uploading entire code repositories, secrets included, before SpaceXSI turned it off, deleted the data and open sourced the tool. Below is each incident, what the company said, and what you can do if you use Grok Bots or Grok apps.

A note on sources. Most of what follows comes from security researchers and the outlets that covered them. Where SpaceXSI (formerly xAI) has responded, we quote it. Where it has not, we say so. Researchers selling security products have a reason to make problems sound serious, so we stick to what they documented and leave out their sales claims.

Over 35,000 Grok-built apps open to anyone

The newest story broke on November 10. Security company Claroc said that of 37,571 apps built with Grok that it found online, 35,578 opened for anyone without a sign-in. The Hacker News reported the findings on November 11.

These are the apps Grok makes from a description typed into its chat, a feature opened to every Grok plan on August 19. Each published app gets its own address on grok.me. Most of the open apps were harmless: games, landing pages and calculators. But about 1 in 10 held internal business or personal data, and the researchers rated roughly 2 percent as high or critical.

The examples are uncomfortable. They include a hospital group's searchable list of more than 3,500 employees, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet app whose code held every employee's password in plain text. Claroc also found internal data from 30 identifiable organizations, 26 of them with more than 1,000 employees and 6 in the Fortune 500.

The most striking finding was 24 open apps built by staff at SpaceXSI and X. According to the researchers, they included a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X advertising proposal to a U.S. federal agency marked confidential. SpaceXSI has since taken down all 24 staff apps, the researchers said, but not other users' open apps.

Why the apps were findable

No hacking was involved. When anyone opens an app, their computer looks up its grok.me address in DNS, and passive DNS services keep a searchable record of those lookups. Grok suggests four random words as each app's name, which is hard to guess, but a name stops being secret once it appears in those records. The researchers found the addresses with common discovery methods and loaded each app's first page once, without signing in.

The bigger issue is the default. In the paid account Claroc tested, publishing an app offered three access settings, "Anyone with the link", "Invited users" and "Only you", and "Anyone with the link" was already selected. For comparison, the researchers said ChatGPT's app builder set a shared app to "Only me" until they changed it.

Claroc also tested two apps of its own with made-up data. A contact list published with the default setting got a database but no sign-in, so a stranger could add rows. A customer list for a small sales team got "Continue with Google" and "Continue with X" buttons that Grok added by itself, but the code added every person who signed in to the team before checking whether they belonged. An uninvited Google account could view, edit and delete customer records. The researchers stress they ran these tests only on their own apps.

What SpaceXSI said about the apps

The researchers reported the findings through the address in SpaceXSI's security.txt file on November 8 and 9. By the time they published, the company had not replied to the report, but it had answered a reporter's questions. As the researchers describe it, the company said Grok apps stay private until their creator shares them, that publishing takes several steps including a choice of access setting and a legal disclaimer, and that employee accounts default to "Only you".

Claroc asked SpaceXSI to make "Only you" the default for everyone and to add an option limiting an app to a company's own email domain. As of November 11, neither change had been announced.

Grok Bot: an unpatched sandbox chain

On November 8, Omri Segev Moyal of security firm Profero published a report titled "The Rootkit Built Into Grok Bot." Grok Bot gives each account a cloud computer where its Bots run, with a shell, a browser and logins to connected services. Profero says that sandbox is reachable from inside in ways it should not be.

The report describes a chain of services that answer ordinary requests without checking who is asking. In Profero's account, a command run inside a Bot can reach an unprotected Docker service on the underlying virtual machine and gain root. From there it can read the account's tokens and a long lived credential stored in plain text, run commands from anywhere on the internet using a password built into the sandbox image, reach the account's saved files, and keep that access even after tokens are rotated. Profero summed it up as "a stealer log with a live shell attached."

The report lists related issues too: imported browser cookies stored in plain text, a Chrome debugging port with no authentication, and passwordless root at boot. It rated several findings Critical, with scores of 9.0 to 9.6 out of 10.

How an attacker gets the first command in. Runlayer, which published its own reproduction of the chain on November 10, points to prompt injection: hidden instructions placed in a web page, a cloned repository or an installed package that a Bot reads while doing its job. No login is needed. Profero and Runlayer also say all Bots in one Grok account share the same user, files and credentials, so one compromised Bot means all of them.

Disclosure. Profero says it sent a full report covering eight vulnerabilities to xAI and Cursor on August 24, followed up several times, gave a 30 day disclosure notice on September 18, and re-tested new builds through September and October with the same results. It says neither company acknowledged the report beyond an automated reply. Its verdict on November 8: "Nothing in the chain is fixed." SpaceXSI has not responded publicly, and we could not confirm the findings independently. Profero withheld identifiers, keys and proof of concept code.

Grok Build uploaded entire repositories

The best known leak this year came from Grok Build, the terminal coding tool, not the chat app builder of the same name. In mid July, a researcher posting as cereblab captured the tool's network traffic and reported that Grok Build CLI version 0.2.93 was sending complete local Git repositories, including full commit history, untracked files and .env files with unredacted secrets, to a Google Cloud storage bucket run by xAI. In one documented case it moved 5.1 GiB when roughly 192 KB would have answered the request. The researcher said turning off the "Improve the model" setting did not stop it.

Musk replied on X on July 13: "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted. Zero anything whatsoever will remain." On July 15 the company posted its own account. It said Grok Build "has fully respected zero data retention" for users with that setting, that users could always disable upload in the CLI, and that "in the early beta, data retention was enabled by default for non-ZDR users." It said default retention was disabled for all users starting July 12 and that previously retained coding data was being deleted.

Around July 16, SpaceXSI published Grok Build's source code on GitHub under the Apache 2.0 license, so anyone can now read what the client sends. Reports at the time noted that disabled upload code remains in the repository and that the models and cloud services behind the tool stay closed. Nobody outside the company has confirmed that the deletion was completed.

An older lesson: the 2025 API key leak

Leaks at xAI are not new. On March 2, 2025, a developer with an x.ai email address committed an xAI API key to a public GitHub repository in an .env file. Security company GitGuardian flagged it automatically. About two months later, after researcher Philippe Caturegli found the key still working, GitGuardian reported it to xAI on April 30. The key could reach public models, unreleased ones and private models with names like grok-spacex-2024-11-04. xAI asked GitGuardian to resubmit through its HackerOne bug bounty, and within hours the repository was removed and the key revoked.

In August 2025, separately, shared Grok chats were found in Google search results because shared links had no protection from indexing. The pattern across three years is the same: things meant to be private became public through a default, a shortcut or a shared link.

What to do if you use Grok Bots

Treat a Bot's computer as untrusted. Profero's main advice is to treat the sandbox as "a hostile machine." Until SpaceXSI says the chain is fixed, do not import your main browser session into Grok Bot, especially logins for email, banking, payments or your company's single sign on.

Give Bots their own accounts. Connect Bots to dedicated accounts with only the access the job needs, not your personal Gmail or your company admin account. Because every Bot in one Grok account shares credentials, splitting sensitive work across separate Grok accounts limits the damage if one Bot is tricked. Our guide to using Grok Bots safely covers narrow connectors in more detail.

Be careful what a Bot reads. Prompt injection works through content: a web page, a repository, a package, an email. A Bot that browses the open web or clones unfamiliar code is the riskiest kind to give strong credentials to.

Keep secrets out of the sandbox. Do not leave long lived API keys, SSH keys or password exports in files a Bot can read. Use short lived keys where you can, and know how you would rotate them.

Check shared Bots before you add them. A shared Bot's instructions run with your connectors and your access. On GrokShelf, every listing links to its source, and verified Bots are re-checked against their live x.ai page, but you should still read what a Bot asks for before you connect it to anything important.

What to do if you build apps with Grok

Open each published app on grok.me and check its access setting. Anything with real data should be "Invited users" or "Only you". The researchers found that "Only you" made an app return an error to strangers for both the page and its data. Then sign in with an account from outside your team: if it gets in, the app needs a list of who is allowed. Search the app's code for names, emails and passwords, and unpublish apps nobody owns; unpublishing takes an app offline within seconds.

For IT teams, Claroc's advice is to find out which AI app builders staff use, since tools like Grok, Lovable, Replit, v0 and Bolt can be used without IT ever setting them up.

What to do if you use Grok Build

Update to the current release, check that data upload is off in the CLI settings, and rotate any secret that sat in a repository you opened with version 0.2.93 or nearby builds in July. The source is public on GitHub, so you can check for yourself what the client sends.

What we are watching

Three things: whether SpaceXSI changes the default for new grok.me apps to private, whether it responds to Profero's report and patches the sandbox chain, and whether it publishes a security page or changelog for Grok Bot. We will update this post and add any fixes to the Grok timeline. For this week's other Grok Bot news, see Grok Bot fixes, Grok 4.8 and Musk on Opus 5.5.

Questions people are asking

Was Grok's source code leaked? No. No leak of Grok model weights or SpaceXSI's internal code has been reported. The incidents involve user data: user repositories uploaded by Grok Build, user apps left open on grok.me, and a 2025 API key. Grok Build's client code is public because SpaceXSI released it in July.

Is Grok Bot safe to use? It depends on what you connect. The sandbox flaws Profero describes are unconfirmed by SpaceXSI and, by Profero's account, unfixed. Bots with narrow access to dedicated accounts carry far less risk than Bots holding your main browser session and email.

Were my Grok chats leaked? Nothing reported this year shows private Grok chats leaking in bulk. The 2025 incident involved chats people had shared by link. Separately, Adversa AI reported in August a prompt injection technique that it says could send a chat's data to an attacker when Grok summarizes a malicious page, and said it was still unfixed on August 19.

Did SpaceXSI delete the Grok Build uploads? Musk and the company both said the data would be deleted. No independent check has confirmed it.