More Than 35,000 Grok Build Apps Accessible Without Login, Including Corporate Secrets and Medical Records

Security research firm Claroc found that 35,578 of 37,571 online applications created with Grok Build, or about 94.7%, could be accessed without logging in. According to Odaily, an estimated 650 to 800 applications contained private or sensitive data, including internal corporate documents, medical records, employee information and plaintext passwords; the data involved six Fortune 500 companies. Twenty-four applications were created by employees of Musk’s SpaceXSI and X and included internal sales plans, customer information and confidential advertising proposals for U.S. federal agencies. Researchers said Grok app-sharing links could be discovered through DNS records and that some applications lacked access controls. SpaceXSI has taken down the 24 applications associated with it, but related applications created by other users remain accessible.