Grok app builder left 35,578 apps open, leaking business data
Original title: Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords
Claroc found ICU records, employee rosters, and plain-text passwords in apps that opened with no sign-in.
Claroc researchers checked more than 43,500 grok.me addresses from passive DNS and opened each app once without signing in. Of 37,571 apps still online, 35,578 (94.7%) were readable by anyone. About one in ten held sensitive or internal data, including patient details, staff records, and passwords stored in downloaded code. SpaceXSI, formerly xAI, removed its own 24 exposed apps after the report but not other users’ apps.
Unconfirmed: SpaceXSI says apps stay private until shared, while Claroc says every open app went through those publishing steps.
- Only 1,993 of the online apps asked for a sign-in.
- Confirmed cases included a hospital roster of more than 3,500 employees and 18 plain-text passwords.
- Thirty other identifiable organizations were exposed, including six Fortune 500 companies.
- Paid-account apps defaulted to public link access, Claroc said.
- A team app checked Google identity but not team membership.
Impact: Public apps exposed business records, passwords, and patient data.
| Product | Affected |
|---|---|
| SpaceXSI Grok app builder | — |
- 1.Find which AI app builders staff use, including Grok, Lovable, and Replit.
- 2.Check each app’s access settings and test sign-in with an outside account.
- 3.Search app scripts for passwords and unpublish apps nobody owns.
From the original article
3 min read at cybersecuritynews.com
Researchers found that apps built with Grok’s app builder are open to Anyone online. Thousands of these apps hold private business data, staff details, plain-text passwords, and patient information. No hacking was needed to reach them.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.