Law Firm Growth JournalThe latest growth strategies in marketing and AI enablement for law firms
Last updated Nov 13, 2026Written and edited by Ali PeivandizadehNo ads. No sponsors.
AI at Work · Action

Check if staff built AI apps that anyone can open

By Ali Peivandizadeh, business growth and AI implementation specialist.

Published Nov 13, 2026 · Last checked Nov 13, 2026 · Last changed Nov 13, 2026
The short answer

Ask this week which AI app builders your staff use. Open every app they built in a private browser window. An app with client facts must ask for a sign-in, or it must come down.

Verdict
ACT
For
All practice areas. All firm sizes. Owner, office manager.
Cost and time
No cost. About two hours for a firm of ten people.

Why

Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time. A firm with no list of them cannot know what is open.

What to do

  1. Ask every lawyer and staff member which AI app builders they have used for firm work.
  2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
  3. List every app they built, and who owns it.
  4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
  5. Change each open app to invited users only, or unpublish it.
  6. Unpublish every app that nobody owns.
  7. If an open app held client facts, tell the managing lawyer the same day. Write down what was in it and how long it was open.
  8. Add one line to the firm's AI policy. No client facts go into an app builder the firm has not approved.

What data may go in

Until the firm has approved a builder and read its terms: public information only. No client facts, no staff records and no passwords.

Who checks the output

The office manager keeps the list of apps. A lawyer decides what to do when client facts were open.

The rule to check

ABA Model Rule 1.6(c) requires reasonable efforts to keep client information away from outsiders. Your state has its own version of the rule. ABA Formal Opinion 483 covers a lawyer's duties after a data breach. If client facts were open, your state's breach notice law may also apply.

What can go wrong

Other app builders have had the same problem, so look at all of them and not only at one. A new app can be open again next month. Put a monthly look on the office manager's calendar.

Sources

Plain text version