Security researchers have discovered more than 35,000 applications built using Grok’s AI app builder that were accessible online without a login, with some exposing confidential business information, medical records, and employee passwords.
In a report by cybersecurity firm Claroc, 35,578 of the over 37k active Grok-built apps examined, or nearly 95%, could be accessed without authentication. While most were simple tools such as games and calculators, researchers estimated that roughly one in ten contained internal business or personal information.
Among the exposed applications were some created by SpaceXSI and X employees and included a confidential employee onboarding plan, a sales territory map covering accounts, and an advertising proposal for an agency. Other exposed data included a health patient’s medical information, a hospital staff directory, and employee passwords stored in plain text.
The researchers traced the exposure partly to Grok’s publishing settings, which offered “Anyone with the link” as the default option in their tests. Those links could be discovered through searchable DNS records, allowing outsiders to find applications without receiving the links directly.
Claroc also found that a test application generated by Grok contained faulty authentication logic, allowing an unauthorized user to access, modify, and delete records.
SpaceXSI said applications remain private until users choose to publish them and that employee accounts default to private. Following disclosure, the exposed staff-built applications were removed but other publicly accessible apps remained online at the time of the report.
Claroc has begun notifying affected organizations and recommends restricting sensitive applications to invited users or private access.
Leave a Reply