Enabling with AIThe latest strategies for AI enablement in your business
Last updated Nov 14, 2026Written and edited by Ali PeivandizadehNo ads. No sponsors.
AI at Work · Action

Check if your staff built AI apps that anyone can open

By Ali Peivandizadeh, business growth and AI implementation specialist.

Published Nov 14, 2026 · Last checked Nov 14, 2026 · Last changed Nov 14, 2026
The short answer

Find out this week which AI app builders your staff have used for work. Open every app they built in a private browser window, signed out. If an app with customer or staff data opens, take it down the same day.

Verdict
ACT
For
Any business. All sizes. Owner, office manager or IT.
Cost and time
No cost. About half a day.

Why

Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time. An owner with no list of them cannot know what is open.

What to do

  1. Ask every team which AI app builders they have used for work.
  2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
  3. List every app, the data in it, and who owns it.
  4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
  5. Change each open app to invited users only, or unpublish it.
  6. If an open app held customer or staff data, write down what was in it and how long it was open.
  7. Ask a lawyer whether anyone must be told.
  8. Write a one-line rule. No customer data, staff records or passwords go into an app builder the owner has not approved.

What data may go in

Until the owner has approved a builder and read its terms: public information only. No customer data, staff records or passwords.

Who checks the output

The owner or the office manager keeps the list of apps and tests each one. In a larger company, IT does.

The rule to check

State breach notice laws apply when personal data is exposed. Some industries have their own rules on top. A contract with a customer may also require notice.

What can go wrong

The same problem has been reported at other app builders, so check all of them and not only one. A new app can be open next month. Put a monthly check on one person's calendar.

Sources

Plain text version