Cybersecurity

A Free Add-On Can Read Every Doc You Own

A free Grok add-on on the Google Workspace Marketplace asks to see, edit and delete all your Docs and Slides. Any employee can install it. Here is the setting that stops it.

CybersecurityBy Servola Tech Desk2026-07-296 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A Free Add-On Can Read Every Doc You Own

Key takeaways

A free add-on published by SpaceXAI, last updated on 21 July 2026 and installed more than 6,000 times, asks to see, edit, create and delete all Google Docs documents and all Google Slides presentations. Any employee can grant that without asking you.
The word carrying the weight in those permission strings is all. The add-on does not receive the file on screen; it receives every document that account can reach, including everything colleagues have shared into it.
Google's allowlist only governs users whose Manage access to apps setting already sits on allowlisted apps only. If yours sits on any apps, an allowlist you spent an afternoon building governs nothing.
Removing an app from the allowlist does revoke access, even for users who still have it installed. Changes can take up to 24 hours to apply, so this is not a same-hour fix during an incident.
Because the add-on costs nothing, no invoice is raised and no euro or pound threshold is crossed, so the vendor review that a paid seat would have triggered never runs at all.

What the listing actually asks for

The listing sits in the Google Workspace Marketplace under the name Grok, published by SpaceXAI, last updated on 21 July 2026. It costs nothing, it has passed six thousand installs, and it runs inside Docs, Sheets and Slides. Installing it takes roughly the effort of adding a browser extension, and it leaves no trace in any system your finance team watches.

The permissions are the part worth reading slowly. The listing asks to see, edit, create and delete all Google Docs documents, and to do the same to all Google Slides presentations. It also asks to view and manage spreadsheets where it is installed, to connect to external services, to display and run third-party web content in prompts and sidebars, and to read the primary account email address. The word doing the work in those strings is all. This is not access to the document open on screen. It is access to the document estate that account can reach, which in a normal company includes every file a colleague has ever shared with that person.

The vendor decision moved to whoever clicks Install

Why it matters: the choice of which AI company processes your commercial documents is now made by whoever clicks Install, not by anyone who has read a contract. Procurement was built to catch vendors arriving through the front door, with an invoice, a security questionnaire and a signature. The add-in marketplace is a side door that was always there, and a frontier model walked through it.

The control does exist. In the Google Admin console the path runs from Menu to Apps, then Google Workspace Marketplace apps, then Apps list, then User Install Settings, and it offers three states: users can install any apps, only allowlisted apps, or no apps. That is the entire decision, and most organisations have never opened the page to look at which of the three they are running.

The allowlist carries a catch that cuts both ways. Google's own documentation states that the allowlist affects users who have Manage access to apps set to allow only allowlisted apps, which means an allowlist assembled while the setting sits on any apps is decorative. The same documentation is blunt about the other direction: users lose access to an app when you remove it from the allowlist, even if they still have it installed. The revocation is real, and it reaches installations you never approved.

Outlook runs a different ladder

The same company shipped a Grok add-in for Outlook through the Microsoft Marketplace, on the same distribution logic: standard marketplace, standard install, no enterprise agreement in the path. Microsoft governs mail add-ins with four cumulative permission levels rather than a scope list. They run restricted, read item, read/write item, and read/write mailbox, and each one contains the ones below it.

The top rung deserves a minute of your attention. Microsoft describes read/write mailbox as allowing an add-in to read and write all properties of any item in the mailbox, to create, read and write any folder or item, and to send an item from that mailbox. Sending is the line to sit with, because an add-in at that level is not a reader of your mail but a participant in it. Microsoft also tells you where to look: the requested permissions appear in the Marketplace listing before you install, and the required permissions of already-installed add-ins are visible in the Exchange Admin Center. Check the tier your tenant has actually granted rather than assuming it, because the listing is the only place that answer is authoritative.

Your processor agreement does not stretch this far

Under the GDPR your company is the controller for the personal data sitting in those documents and mailboxes, which is to say client names, staff records, pricing, everything a working business writes down. Any third party processing that data on your behalf needs a controller-to-processor agreement under Article 28. That is not a formality that legal can paper over afterwards; it is the instrument that says what the processor may do with the data and what happens when it is finished.

The agreements you already hold cover Google and Microsoft. They do not extend to a separate publisher operating its own service under its own terms, and the Marketplace listing is explicit about that: the privacy policy and terms of service both point to the publisher's own domain, not to your Workspace contract. In the United Kingdom the Information Commissioner's Office treats controller diligence over processors as a live obligation rather than a filing exercise, and a British firm whose staff have installed a third-party AI add-on across a document estate has taken on a processor it has never assessed.

The zero price is precisely why this bypasses everything. Nothing is invoiced, so no purchase order is raised, so no pound or euro approval threshold is crossed, so the vendor review that a paid seat would have triggered automatically never runs. Free software does not mean free of obligation, and the cheapest tool in your estate can carry the widest data access in it.

The setting to check before Friday

Start with the inventory rather than the policy. Open the Admin console, read the list of Marketplace apps your users have already installed, and note which of the three install states you are running. If it is any apps, you have not chosen a vendor policy, you have chosen to have none. Then do the equivalent in the Exchange Admin Center for Outlook add-ins and read the permission tier each one declares. Allow the 24 hours Google warns about when you change the setting, which is exactly why this belongs on a calm Thursday and not in the middle of an incident.

The wider lesson outlasts this one add-on. The app marketplace is now a procurement channel, and it is the only one in your business with no approval step, no invoice and no counterparty review. Treat an install prompt asking for all documents the way you would treat a supplier asking for a copy of the file server, because functionally that is the request. The add-on is not the problem; the fact that nobody had to ask you is.

Frequently asked questions

Does this mean the Grok add-on is malicious?

No, and nothing here suggests it is. The permissions it requests are the ordinary ones for an add-on that edits documents on your behalf, and a spelling tool would request something similar. The point is governance, not accusation: a scope that broad should be granted by someone who owns the risk, under an agreement your company has read, rather than by an employee who wanted help with a slide deck.

We run Microsoft 365 rather than Google Workspace. Are we exposed to the same thing?

Yes, through a different mechanism. Microsoft distributes mail add-ins through its own marketplace and grades them across four permission levels up to read/write mailbox, which permits reading, writing and sending from the mailbox. The check is the Exchange Admin Center, where the required permissions of installed add-ins are listed.

Can we simply tell staff not to install AI add-ons?

You can, and it will not hold. A written rule competes with a free tool that visibly saves an hour a day, and the tool tends to win. The setting is the durable control, because it decides the question once for everyone instead of asking several hundred people to decline something useful every week.

The governance failure here is not that an AI vendor reached your documents. It is that reaching them required no decision from anyone accountable for them. Fix the setting, then fix the assumption that vendors arrive through procurement.

Google WorkspaceMicrosoft 365GrokxAIShadow AIGDPRVendor Risk

Grok's Designer Is The Defendant, Not The Platform

A UK member of parliament is suing xAI as the builder of Grok under data protection law, and asks the High Court to order permanent technical measures on the model.

4 min read

AI Policy

xAI Wants Its User to Pay Its Legal Bills

xAI's complaint against a Grok user pleads exactly one cause of action: breach of its Terms of Service. It asks the user to indemnify xAI's legal costs. What European owners should read in their own vendor terms.

6 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles