Claroc found 35,578 of 37,571 active Grok-built apps—94.7%—accessible without login because “Anyone with the link” was the default publishing option. Exposed material included patient records, passwords and SpaceXSI documents covering 594 sales accounts. SpaceXSI removed only its 24 employee apps.