Thousands of Grok-Built Apps Exposed Due to Default Access Settings
Security researchers identified over 35,000 publicly accessible applications containing sensitive internal business and personal data.
1Massive Data Exposure Identified
Security firm Claroc discovered 35,578 Grok-built applications accessible online without authentication. Out of 37,571 total apps scanned, the vast majority lacked sign-in requirements. These exposed projects include games, calculators, and landing pages, but approximately 10 percent contain sensitive internal business information or private personal data from various organizations.
2Internal SpaceXSI Apps Compromised
The exposure includes 24 applications created by staff at X and SpaceXSI. These internal tools contained confidential onboarding plans, sales territory maps covering 594 accounts, and advertising proposals for federal agencies. While SpaceXSI removed these specific apps after reporting, the company has not addressed the remaining thousands of public apps.
3Broad Industry Impact Observed
Researchers identified internal data from 30 distinct organizations across sectors like construction, energy, healthcare, and defense. Six of these entities are Fortune 500 companies, and 26 employ over 1,000 people. Exposed materials range from hospital employee lists and intensive care patient briefings to fire department shift boards and plain-text passwords.
4DNS Vulnerability and Enumeration
Grok apps reside on unique subdomains of grok.me. When users visit these links, their computers perform DNS lookups, which are recorded by passive DNS services. Attackers can search these records to enumerate live projects. Although Grok uses random four-word names, these names become discoverable once they appear in searchable DNS logs.
5Default Settings Create Risk
The platform defaults to 'Anyone with the link' access for new apps. Researchers contrast this with ChatGPT, where apps default to 'Only me' access. Even if a URL is hard to guess, the current Grok configuration ensures that any discovered link provides immediate, unauthorized access to the underlying application data.
6Flawed Authentication Mechanisms
Testing revealed that Grok-added authentication is easily bypassed. In one test, a customer list app allowed uninvited Google accounts to view, edit, and delete records because the code failed to verify team membership. The system automatically added any user who signed in to the team, regardless of their actual authorization status.
7Corporate Response and Mitigation
SpaceXSI stated that apps remain private until creators share them and that employee accounts default to 'Only you' settings. However, the researchers' findings contradict this, as they found 24 internal apps publicly accessible. The company has not confirmed if it will contact other affected users, prompting researchers to email organizations directly.
8Future Security Considerations
This incident highlights the risks of AI-generated code lacking robust access controls. Researchers recommend that SpaceXSI change the default setting to 'Only you' and implement domain-based access restrictions. Users should audit their existing Grok projects and manually verify that access permissions are set to the most restrictive level possible.