Researchers Find 35,578 Public Grok-Built Apps, Some Exposing Sensitive Data

Summary

Researchers found 35,578 of 37,571 Grok-built apps accessible without sign-in, with some exposing sensitive business and personal data. Tests on their own apps also revealed missing or flawed access controls; SpaceXSI took down 24 staff apps.

Key points

Claroc researchers said 35,578 of 37,571 Grok-built apps they found were accessible to anyone without signing in.
About one in ten open apps contained internal business or personal data; the researchers estimated roughly 2% had material rated high or critical.
Exposed examples included employee lists, a patient briefing, a live fire-department shift board, and a timesheet with employee passwords in plain text.
The researchers said 24 open apps were built by staff at X and SpaceXSI; SpaceXSI had taken those apps down by publication.
On two apps they created for testing, the researchers found one had no sign-in protection and another let an uninvited account access and change customer records. They did not test whether discovered apps allowed such changes.
Researchers said app subdomains can be found through passive DNS records, even when names are difficult to guess.
They recommended making “Only you” the default and adding access restrictions for an organization's email domain; the article said the company had not stated whether it would contact owners of other open apps.

Article Details

Event Type: Exposure of publicly accessible AI-built applications due to permissive sharing settings and insecure generated access-control logic.
Impact: Claroc researchers found 35,578 of 37,571 Grok-built apps open without sign-in; they reported that about one in ten contained internal or personal data, and estimated roughly 2% of open apps contained material rated high or critical. Exposed examples included employee information, patient and operational data, confidential business material, and a contractor timesheet with employee passwords in plain text. In tests on their own apps, the researchers demonstrated unauthorized access and data modification, but said they did not test whether the discovered apps could be changed. SpaceXSI had taken down 24 staff-built apps by publication, according to the researchers.