Ethical Hacking News
Over 35,000 Grok-built apps have been exposed online, with some leaking confidential data and passwords. This revelation highlights the need for enhanced data security and confidentiality measures, particularly for companies using AI-powered app builders.
Over 35,000 Grok-built apps were found to be exposed online, compromising sensitive data and passwords. Many apps, including staff apps from X and SpaceXSI, were found to be open to anyone without a sign-in. Internal business and personal data, including confidential onboarding plans and sales proposals, were exposed. 30 other organizations' internal data, including those in construction, energy, healthcare, and defense, were also exposed. Only 24 staff apps from X and SpaceXSI were taken down, while other users' apps remain exposed. Approximately 2% of the open apps contained material serious enough to be rated as high or critical. Grok's AI-powered app builder allows users to create apps with public access settings, making it easy for unauthorized access. Claroc recommends organizations to identify AI app builders, check for open apps, and verify access settings to ensure data security. SpaceXSI has taken steps to address security concerns, but its response has been limited.
The discovery of over 35,000 Grok-built apps exposed online has sent shockwaves through the cybersecurity community, highlighting the pressing need for enhanced data security and confidentiality measures. The revelation, made by Claroc, a security company, has revealed that a significant number of these apps, including some built by staff at prominent companies like X and SpaceXSI, are openly accessible to anyone without a sign-in, thereby compromising sensitive data and passwords.
According to the research, the majority of these open apps were games, landing pages, and calculators, while approximately one-tenth contained internal business or personal data. This includes confidential onboarding plans for new sales hires, sales territory maps, and X advertising proposals marked confidential. Notably, SpaceXSI, the company behind Grok, has since taken down all 24 staff apps but not other users' apps.
The exposed material also includes internal data from 30 other organizations, including those in the construction, energy, healthcare, and defense sectors. Out of these, 26 have more than 1,000 employees, and 6 are Fortune 500 companies. Approximately 2% of the open apps contained material serious enough to be rated as high or critical. The leaked data includes a hospital group's searchable list of over 3,500 employees, an intensive care briefing on a single patient, a fire department's live shift board, and a contractor's timesheet whose code held every employee's password in plain text.
Grok, the AI-powered app builder, was launched on August 19 with a chat builder feature that allows users to create a working app from a description typed into its chat interface. The app shares the Grok Build name with a separate terminal coding tool, and each published app gets its own subdomain of grok.me, with its creator choosing who can open it. However, an app's address does not stay secret, as opening it makes the visitor's computer look up its subdomain in DNS, which can be accessed by anyone with an account.
The setting for an app's access is crucial, as it determines who can view and edit the content. In this case, 24 apps built by staff at X and SpaceXSI were found to be open to anyone, with the "Anyone with the link" setting already selected. This highlights the importance of proper access control and the need for companies to regularly monitor their employees' app permissions.
In response to the research, Claroc has recommended several checks for organizations to ensure the security of their Grok-built apps. These include identifying the AI app builders used by staff, checking for open apps with internal data, verifying the access settings for each app, and trying to sign in with an account from outside the company to see if the app allows unauthorized access.
To address this issue, SpaceXSI has taken steps to address the security concerns raised by Claroc. However, the company's response to the researchers' report has been limited, and it has not been clear whether they plan to take further action to protect the sensitive data and passwords exposed in these apps.
The discovery of these exposed apps serves as a wake-up call for organizations to review their data security measures and take steps to prevent similar incidents in the future. As AI-powered app builders continue to grow in popularity, it is essential to prioritize data security and confidentiality, ensuring that sensitive information is protected from unauthorized access.
Related Information:
https://www.ethicalhackingnews.com/articles/Grok-Built-Apps-Exposed-Online-A-Looming-Threat-to-Data-Security-and-Confidentiality-ehn.shtml
https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html
https://cybersecuritynews.com/grok-ai-app-builder-exposes-data/
Published: Wed Nov 11 08:09:03 2026 by llama3.2 3B Q4_K_M
