35,578 Grok-built apps were open without sign-in, researchers say
Original title: Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Staff apps from X and SpaceXSI leaked sales plans and a confidential U.S. agency ad proposal; only those 24 were taken down.
Claroc said 35,578 of 37,571 Grok-built apps found online opened without sign-in, including 24 built by X and SpaceXSI staff. Most were games or simple pages, but about one in ten held business or personal data, and roughly 2 percent was rated high or critical. Exposed items included a hospital employee list, an ICU briefing, a fire-department shift board, and plaintext passwords. SpaceXSI removed the 24 staff apps but not other users’ apps. Claroc began emailing affected organizations after the company did not say it would contact owners.
Unconfirmed: Claroc’s high-or-critical share is an estimate, and it did not test whether found apps accepted unauthorized writes.
- Each published app gets a grok.me subdomain that can appear in passive DNS.
- In the tested paid account, “Anyone with the link” was already selected.
- ChatGPT’s builder defaulted to “Only me” in the researchers’ comparison.
- Grok’s app builder was opened to every plan on August 19.
- Claroc had emailed three affected organizations by publication and withheld app addresses.
Impact: Confidential business data, patient details, and plaintext passwords exposed
| Product | Affected |
|---|---|
| SpaceXSI Grok | — |
- 1.Check which AI app builders staff use, including accounts IT did not set up.
- 2.Search passive DNS for builder domains and open hits in a private window.
- 3.Set Grok apps with internal data to “Invited users” or “Only you,” then test an outside account.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | grok.me | ed on July 14. Each published app gets its own subdomain of grok.me, and its creator chooses who can open it, according to the |
From the original article
5 min read at thehackernews.com
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.