Grok: decide who may use each published app function
An app built with AI can look internal while remaining accessible outside the company. Define its permitted audience and check each operation before putting real data into the workflow.
Читать на португальскомBy Pentesty
Make publication a business decision
In research published November 10, Claroc reported that 35,578 of 37,571 live Grok apps opened without signing in. That count describes accessible pages; it does not establish 35,000 confirmed incidents. The firm tested data modifications only on two apps it owned. These are research findings that Pentesty has not independently reproduced.
The editorial proposal is to give the process owner a concrete decision before publication: which people should be able to inspect which information and perform which actions? An app for organizing sales demonstrations might start with fictional data.
Record three audiences before release
In an authorized test copy, prepare three access conditions: a visitor without a session, a test account outside the team and an account invited for the expected role. Describe the permitted result for each. Also record who approved the exposure and how long that address is expected to remain available.
The choice should follow the content. A public demonstration might allow anonymous inspection of fabricated information, while an internal tool requires a restricted audience. This record lets reviewers check publication without relying on the impression of the person who just built the app.
Connect each operation to its approved audience
List the actions present in the assessed version, such as reading, creating, editing, deleting and exporting. Connect each action to the audience authorized to perform it. Use fictional records with distinct identifiers to track the outcome. An entry-page screenshot helps document the interface; operation evidence needs to show the decision actually observed.
For each attempt included in scope, retain the test identity, time, record identifier and response. The aim is to distinguish a permitted action from a demonstrable refusal. Our analysis of deploying Node-RED flows describes another setting in which publication authority needs to follow the routes that become available.
Make the published version the acceptance object
Associate the result with the test address and the version examined. Record the data, integrations and functions present at that point.
A later request, such as adding contact imports or spreadsheet exports, should return to the access decision. Compare previous and new operations using the same audience matrix. The team can then decide which checks to repeat before approving the next use with real data.
Prepare a withdrawal that can be verified
Define in advance who can suspend publication and how to contact that person. In the lab, verify the expected result after withdrawing an invitation or suspending the app. Retain observations for each test identity and record any access that continues working so the accountable owner can assess it.
Withdrawal also needs to consider the authorized integrations used in the exercise. Check whether they retain their own sessions, permissions or copies. Our analysis of revoking marketing access helps organize that review. If evidence of actual exposure emerges, refer it to the internal response process while preserving the evidence needed for investigation.
Deliver a conclusion with useful limits
The final record should identify the version, audiences used, operations checked and outstanding exceptions. State who accepts each exception and which changes require review. A decision might authorize a demonstration with fabricated data while postponing customer use until a particular function receives the control that the owner requires.
Keep the conclusion tied to the observed scope. This proposed exercise assesses the organization’s own apps or an expressly authorized lab. It does not call for discovering third-party apps, using credentials found online or altering other people’s data.
Frequently asked questions
Does the open-app count prove an intrusion?
The count attributed to the research measures accessible pages. A conclusion about unauthorized access or copied data at a company requires its own evidence, assessed through the response process.
Do I need to test other companies’ apps?
The exercise uses a copy you own or a lab with express authorization. Prepare fictional data and accounts, and keep every action within the approved scope.
How should checks be selected after a change?
Compare audiences, operations, content and integrations with the accepted version. Repeat checks affected by the change and record who approved the results and outstanding exceptions.
What evidence supports introducing real data?
The owner should accept results for the intended version and purpose, including permitted operations, expected refusals and outstanding issues. The decision depends on the organization’s context and agreed criteria.
Sources and references
Original Pentesty analysis, published November 11, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.