Security researchers have found that 35,578 apps built with SpaceXSI’s Grok Build were accessible without sign-in, including tools that exposed patient information, employee records, plaintext passwords and confidential corporate material. Claroc said it tested 43,551 grok.me addresses on Nov. 8, finding 37,571 live apps; 94.7% of those opened to anyone who discovered the link. Claroc’s investigation said the researchers did not authenticate to, modify or delete data from other users’ apps.
The exposure appears to stem from the platform’s sharing and publication model rather than a reported software vulnerability with a CVE identifier. Claroc said the publishing interface offered “Anyone with the link,” “Invited users” and “Only you,” with the broadest option selected by default in its paid test account. Publicly discoverable subdomains made the shared applications easier to find, meaning an app owner could believe a link was obscure while its content remained reachable from the internet.
Most of the accessible applications were games, landing pages and calculators. Claroc estimated that roughly 650 to 800 contained private, internal or personal information, with about 2% holding material it rated high or critical in sensitivity. Confirmed examples included a hospital group’s searchable roster of more than 3,500 employees, an intensive-care briefing containing laboratory and ventilator information, a fire department shift board, and a recruiting list containing legal names and personal email addresses. One staff-timesheet application included 18 accounts and plaintext passwords in code delivered to the browser.
The researchers also identified 24 open applications created by employees of SpaceXSI and the social network X. The material included a confidential enterprise-sales onboarding plan with internal system addresses and chat channels, a sales territory map covering 594 strategic accounts, advertising proposals and campaign dashboards, and copies of an X brand-safety playbook. Claroc said SpaceXSI removed those 24 applications after disclosure, but had not taken down applications belonging to other organizations or contacted all affected owners by the time of publication.
Claroc also tested two applications it created itself. One public app allowed an unauthenticated visitor to add data that subsequent visitors could see. A second app included sign-in, but its authorization logic allowed an uninvited Google account to view, alter and delete customer records. Those tests do not establish that every exposed Grok Build app was writable, but they show that public visibility can carry integrity risks as well as confidentiality risks when authentication and authorization are left to generated code.
Organizations using Grok Build should inventory published applications, switch sensitive projects to Only you or restricted invitations, rotate any credentials embedded in source code, and review access logs and downstream systems for suspicious use. Developers should also treat generated applications as untrusted code: require authentication before publishing business or health data, enforce authorization after login, and ensure secrets never reach client-side code. Claroc recommended making private access the default, adding organization-scoped sharing and warning when an app combines a database with no sign-in.
