Claroc says Grok-generated apps leak data publicly by default
Understand this story
Security firm Claroc says that of 37,571 Grok-generated apps it checked that are still online, 35,578 (94.7%) can be accessed without logging in, because the publish dialog preselects "Anyone with the link" by default. Claroc says that on the paid account it used for testing, this option was already preselected; after changing it to "Only you," the test app blocked external access. Claroc says SpaceXSI has taken down 24 employee apps but has not removed public apps created by other Grok users and organizations; because SpaceXSI has not committed to contacting affected app owners, Claroc is notifying them directly.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- The DecoderFeaturedGrok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline
Security firm Claroc found that 35,578 of 37,571 live apps built with Grok's "Build" mode (94.7%) were accessible to anyone with the link, because "Anyone with the link" is preselected in the publish dialog and each app gets a subdomain that appears in searchable passive DNS databases. Exposed material included 24 apps from SpaceXSI and X employees, among them a confidential onboarding plan, a sales territory map with 594 strategic accounts, and ad proposals, plus patient lab values, a 3,500-employee hospital list, and a timesheet app containing 18 plaintext passwords. SpaceXSI said apps are private until shared and that employee accounts default to "Only you," while Claroc said it has taken the 24 employee apps offline but not other users' open apps, and is notifying affected owners directly.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 11 22:00
- Change in the past 24 hours
- -49%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.