文章以英文釋出。
AI SecurityShadow AIData Protection
文章以英文釋出。
Security firm Claroc says 35,578 of 37,571 live apps built with Grok's chat-based app builder, 94.7%, opened for anyone without signing in, and that roughly one in ten of them held internal business or personal data. In its GhostShares 2 report, published 10 November 2026, Claroc lists a confidential sales territory map, an ICU patient briefing, a hospital staff roster and a timesheet app with 18 plain-text passwords among the exposed material. The Cloud Security Alliance followed on 11 November with a research note calling it part of a wider "public by default" pattern in AI app builders, while noting it has not independently verified Claroc's figures.
Nothing here required an exploit. People asked a chatbot to build them a useful internal tool, clicked Publish, and accepted the default.
grok.me (its report gives both 43,551 and 43,601). 37,571 were still online; 35,578 of those loaded with no sign-in, and 1,993 (5.3%) returned a login error.Three defaults lined up. Each published app gets its own hostname, <name>.grok.me, and Grok proposes four random words as the name, which looks secret but is not: hostnames show up in DNS, and passive DNS services record lookups in searchable databases. In Claroc's paid test account, the publish dialog had "Anyone with the link" preselected, ahead of "Invited users" and "Only you". And the generated apps often had a database but no sign-in.
Claroc did not test write access on apps it did not own. On two test apps of its own, it found that an anonymous visitor could add records to an open contact list, and that a "Continue with Google" sign-in added each new user to the team before checking membership, so any outside Google account could read, edit and delete every record.
SpaceXSI's position, as reported by Claroc, is that apps stay private until a creator shares one, and that employee accounts default to "Only you". After the report it removed the 24 apps built by its own staff (CSA says within about two days). Neither source reports a change to the default for ordinary users, or a plan to notify other affected owners; Claroc says it has begun notifying organisations itself.
CSA's note makes the same point: the risk sits with any AI tool that lets a non-developer turn company data into a hosted web app in minutes. The person building it is usually solving a real problem, such as a shift board or a timesheet, and has no reason to think about DNS, authentication or default sharing. Security teams, meanwhile, often do not know the app exists, because it lives on someone else's domain and never passed through a change process.
It is the same gap behind our recent report on a contractor's personal coding agent inside a Pentagon network: the AI tool worked as designed, and the organisation had no view of what was being done with it.
grok.me, and open anything attributable to you in a private browser window. Only test apps that are yours.Steps 5 and 6 come down to giving people an approved way to use AI with company data, and being able to see what goes through it. Obiguard Governance AI provides that for the AI agents and applications your organisation routes through it. In-path inspection checks each prompt and non-streamed response against your policy before the call completes, with guard types for PII, injection and off-scope content plus your own keyword and regex rules, so a request that carries a staff roster or a credential can be flagged, redacted or blocked. Allow-lists bind each agent to an approved provider and model list, and the audit ledger records what was sent, by which agent, and what policy decided. Scope matters: Governance AI only sees traffic that passes through it. It cannot discover or unpublish an app someone built directly in a consumer AI builder, and it does not scan third-party domains. What it does is make the sanctioned route the easier one, with a record of what happened on it. To see how a policy would apply to your use cases, get in touch or read about Governance AI.
Obiguard 位於貴組織每一次 AI 請求之前——依據護欄、合規框架和稽核軌跡篩查提示詞與輸出，而這樣的報導正說明了它們的必要性。
了解運作方式 →