Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords
Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or
Among 37,571 Grok-built apps discovered by security firm Claroc, 35,578 were accessible to everyone without logging in, researchers reported yesterday. The apps encompassed games, landing pages, calculators, and internal business or personal data from 30 organizations in sectors like construction, energy, healthcare, and defense.
Notably, about 1 in 10 contained confidential data, including an onboarding plan for a new sales hire, a sales territory map, and a confidential advertising proposal. SpaceXSI, formerly xAI, promptly removed all 24 staff apps but left others open. Roughly 2% of the open apps contained material serious enough for high or critical rating.
The exposed data included a hospital's employee list, a patient's ICU briefing, a fire department's shift board, and a contractor's timesheet with plain-text employee passwords. Grok AI apps, built via chat, are hosted on subdomains of grok.me, and access restrictions can be set to various levels. However, the researchers demonstrated how uninvited users could bypass these restrictions, gaining unauthorized access to sensitive information.
Grok developers were informed of the findings, requesting default settings and domain restrictions. The researchers are now contacting the affected organizations directly.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
