Over 35,000 Grok Build Apps Found Publicly Accessible, Exposing Sensitive Data

ChainCatcher report: Security research firm Claroc found that of the 37,571 online applications created by Grok Build, 35,578 (approximately 94.7%) are accessible without login, with an estimated 650 to 800 of these containing private or sensitive data. Exposed information includes internal corporate documents, medical records, employee details, and plaintext passwords, affecting six Fortune 500 companies. Twenty-four of these applications were created by employees of SpaceXSI and X, owned by Musk, and contain internal sales plans, customer data, and confidential advertising proposals targeting U.S. federal agencies. Researchers noted that Grok application sharing links can be discovered via DNS records, and some applications lack proper access controls. SpaceXSI has taken down the 24 applications associated with itself, but related applications from other users remain accessible.