# Check if staff built AI apps that anyone can open

By Ali Peivandizadeh, business growth and AI implementation specialist.
Published Nov 13, 2026. Last checked Nov 13, 2026. Last changed Nov 13, 2026.
Section: AI at Work. Verdict: ACT
Who it is for: All practice areas. All firm sizes. Owner, office manager.

Ask this week which AI app builders your staff use. Open every app they built in a private browser window. An app with client facts must ask for a sign-in, or it must come down.

## Why
Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time. A firm with no list of them cannot know what is open.

## Steps
1. Ask every lawyer and staff member which AI app builders they have used for firm work.
2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
3. List every app they built, and who owns it.
4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
5. Change each open app to invited users only, or unpublish it.
6. Unpublish every app that nobody owns.
7. If an open app held client facts, tell the managing lawyer the same day. Write down what was in it and how long it was open.
8. Add one line to the firm's AI policy. No client facts go into an app builder the firm has not approved.

## What data may go in
Until the firm has approved a builder and read its terms: public information only. No client facts, no staff records and no passwords.

## Who checks the output
The office manager keeps the list of apps. A lawyer decides what to do when client facts were open.

## Cost and time
No cost. About two hours for a firm of ten people.

## The rule to check
ABA Model Rule 1.6(c) requires reasonable efforts to keep client information away from outsiders. Your state has its own version of the rule. ABA Formal Opinion 483 covers a lawyer's duties after a data breach. If client facts were open, your state's breach notice law may also apply.

## What can go wrong
Other app builders have had the same problem, so look at all of them and not only at one. A new app can be open again next month. Put a monthly look on the office manager's calendar.

## Sources
- Claroc, security research report, Nov 10, 2026: https://blog.claroc.io/ghostshares-grok-build-apps/
- Cloud Security Alliance, research note, Nov 11, 2026: https://labs.cloudsecurityalliance.org/research/csa-research-note-grok-build-apps-exposed-by-default-2026111/

General information, not legal advice.

Page: https://lawfirmgrowthjournal.com/ai-at-work/check-staff-built-ai-apps-open-to-anyone/