Observed incident

Grok-built apps exposed internal records without requiring sign-in

Reported

Published here

What happened

Claroc found that 35,578 of 37,571 live apps in its sample of published Grok apps opened without sign-in. Some exposed business and personal records. Researchers identified 30 organizations with internal data in open apps, in addition to SpaceXSI and X.

Parties and reporting

Where this happened

Affected:
United States, Brazil, Japan, Thailand

Countries and regions are approximate and come from the sources, not from attacker, vendor or researcher locations. See this report’s footprint on the world map.

AI tools and systems: Grok’s hosted app builder, Published-app sharing settings

Outcome

Claroc says SpaceXSI took down 24 apps built by SpaceXSI and X staff after notification. Claroc began contacting other organizations whose data it found. It did not establish malicious collection or the removal of all exposed material.

Operating lesson

Before publishing an app that contains company or personal data, require sign-in and verify access using an account outside the intended audience.

Evidence and limits

Claroc inspected live first pages and tested edits only on its own dummy apps. Most open apps contained ordinary public material. Builders had to choose to publish. Claroc observed link sharing preselected on its account, while SpaceXSI said its employee accounts defaulted to private.

Sources