Claroc

Over 35,000 Grok-Built Apps Exposed Online, Leaking Confidential Data and Passwords

Security researchers at Claroc discovered 37,571 publicly accessible apps created with Grok's AI app builder, of which 35,578 required no authentication. Among them were 24 internal applications developed by employees at X and SpaceXSI that exposed sensitive materials including onboarding plans, sales territory maps, and confidential advertising proposals. The exposed apps also contained internal data from 30 additional organizations, including six Fortune 500 companies operating in healthcare, defense, and energy sectors. Researchers demonstrated that the default access setting "Anyone with the link" combined with predictable subdomain naming allowed passive DNS reconnaissance to locate the applications. Tests showed that Grok-generated apps frequently lacked proper authentication controls, permitting unauthorized users to view, edit, and delete records. SpaceXSI removed the 24 staff-built apps after notification but has not contacted other affected users. Claroc recommends organizations audit passive DNS records for grok.me subdomains and enforce stricter access settings on all AI-generated applications.