# Check if staff built AI apps that hold customer data

By Ali Peivandizadeh, business growth and AI implementation specialist.
Published Nov 13, 2026. Last checked Nov 13, 2026. Last changed Nov 13, 2026.
Section: AI at Work. Verdict: ACT
Who it is for: All energy sellers. All sizes. Owner, operations, compliance.

Find out this week which AI app builders your staff have used for work. Open every app they built in a private browser window, signed out. If an app with customer data opens, take it down the same day.

## Why
Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time, such as a job tracker or a proposal list. A company with no list of them cannot know what is open.

## Steps
1. Ask every team which AI app builders they have used for work.
2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
3. List every app, the data in it, and who owns it.
4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
5. Change each open app to invited users only, or unpublish it.
6. If an open app held customer data, write down what was in it and how long it was open.
7. Ask a lawyer whether customers or the state must be told.
8. Add one line to your AI rule. No customer data goes into an app builder until the company has read its terms.

## What data may go in
Until the company has read a builder's terms: public information only. No customer names, addresses, bills, meter data or passwords.

## Who checks the output
The owner or the operations lead keeps the list of apps. In a larger seller, compliance decides what to do when customer data was open.

## Cost and time
No cost. About half a day.

## The rule to check
State privacy and breach notice laws apply when customer data is exposed. Meter data needs the customer's permission before anyone shares it. An electricity seller also answers to its regulator for how it protects customer information.

## What can go wrong
The same problem has been reported at other app builders, so check all of them and not only one. A new app can be open next month. Put a monthly check on one person's calendar.

## Sources
- Claroc, security research report, Nov 10, 2026: https://blog.claroc.io/ghostshares-grok-build-apps/
- Cloud Security Alliance, research note, Nov 11, 2026: https://labs.cloudsecurityalliance.org/research/csa-research-note-grok-build-apps-exposed-by-default-2026111/

General information, not legal, financial or engineering advice.

Page: https://energygrowthjournal.com/ai-at-work/check-staff-built-ai-apps-with-customer-data/