Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline

Security firm Claroc found that 35,578 of 37,571 live apps built with Grok's "Build" mode (94.7%) were accessible to anyone with the link, because "Anyone with the link" is preselected in the publish dialog and each app gets a subdomain that appears in searchable passive DNS databases. Exposed material included 24 apps from SpaceXSI and X employees, among them a confidential onboarding plan, a sales territory map with 594 strategic accounts, and ad proposals, plus patient lab values, a 3,500-employee hospital list, and a timesheet app containing 18 plaintext passwords. SpaceXSI said apps are private until shared and that employee accounts default to "Only you," while Claroc said it has taken the 24 employee apps offline but not other users' open apps, and is notifying affected owners directly.