A new report shows that tens of thousands of apps built with AI "vibe-coding" tools are sitting wide open on the internet, no login required. If anyone in your business has ever used a tool like Grok, Lovable, Replit, v0, Bolt, Base44 or Google AI Studio to whip up a quick internal tool, this is worth five minutes of your time today.
What happened
Security company Claroc scanned apps built with Grok, the AI tool from xAI that lets anyone describe an app in plain language and get working software in minutes. Of the 37,571 Grok-built apps the researchers found online, 35,578 were accessible to anyone, with no sign-in required, according to the findings reported yesterday by The Hacker News.
Among those publicly exposed apps, researchers found sensitive business data, employee details, plaintext passwords, and even medical records sitting in the open, as reported by Cybersecurity News. This wasn't limited to small, obscure users either — Cybernews reports that at least 24 exposed apps belonged to employees of SpaceXSI and X, showing that even technically sophisticated organisations can get this wrong.
Why these apps got found so easily
The root problem is how Grok generates shareable links for the apps it builds. According to SC World, the platform places a randomised identifier to the left of the domain name in the URL. That structure means the links can be discovered through passive DNS monitoring services — tools that quietly log every subdomain ever seen on the internet. In other words, attackers don't even need to guess a link or find it leaked somewhere; they can simply pull a list of every app that was ever created and check which ones are still live and unprotected.
Why this matters for Swiss SMEs right now
AI app builders are spreading fast inside businesses precisely because they're so easy to use. A marketing coordinator, an HR assistant or a finance intern can now build a working internal tool — a leave request form, a customer list, a small booking app — in an afternoon, without ever involving IT. That's the appeal, and it's also the risk: these tools are published by default in a way that's easy to find, and nobody told IT the app exists, so nobody is checking whether it's leaking data.
This pattern of "shadow AI" tools appearing without any review is becoming one of the most common new entry points for data leaks. Unlike a server or a laptop, nobody in your business is patching or monitoring an app that IT doesn't know exists.
What to do today
Claroc's own recommendations, as summarised by The Hacker News, are a practical checklist any business owner can run through this week:
- Ask around. Find out which AI app builders staff have actually used — Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio can all be used without any IT setup, so this may be happening without anyone noticing.
- Check what's exposed. Passive DNS lookup services can show whether your organisation's domain has any associated app links out there that nobody remembers creating.
- Lock down what you keep. Any internal app still in use should be set to "Invited users only" or "Only you" rather than left open to the public internet.
- Kill what's abandoned. If an app has no clear owner, no one using it, and no business reason to stay live, unpublish it. An app nobody owns is an app nobody is securing.
The bigger picture
AI coding assistants aren't going away — they're genuinely useful, and banning them outright rarely works in practice. The real fix is visibility: knowing what's been built, where it lives, and who's responsible for it. That's exactly the kind of gap that grows quietly in businesses without dedicated IT oversight, one quick "vibe-coded" tool at a time.
We keep tracking cybersecurity developments like this one because the threat landscape for small and medium businesses changes week to week, not year to year. If your team is already using AI tools to speed up daily work, Flitz.ai can help you bring that same automation into your business in a structured, properly managed way — so the tools you adopt make work faster without quietly becoming a liability.
Switzerland.