Security firm Claroc reports that more than 35,000 apps built with SpaceXSI's Grok AI assistant can be accessed without a login. The firm checked 37,571 apps that were still online and found 35,578 open to anyone, or 94.7 percent, according to the report.
Claroc points to the publish dialog. On the paid account the firm used for testing, "Anyone with the link" was already preselected. Each published app receives its own subdomain on grok.me, and the firm says those names can later be found in commercial passive DNS databases that can be searched by pattern.
Claroc says most of the open apps are games, landing pages, or calculators. About one in ten contained sensitive material, internal business data, or personal information. The firm rates roughly two percent as especially serious and estimates that 650 to 800 apps contained private data. Confirmed examples include an ICU briefing with a patient's lab values, a list of more than 3,500 employees at a hospital group, and a fire department shift schedule. The source code of a timesheet app contained 18 accounts with plaintext passwords.
Twenty-four of the open apps came from SpaceXSI and X employees. They included a confidential onboarding plan with internal system addresses and 19 chat channels,