Claroc Finds 35,578 Exposed Grok Build Apps

Security researchers at Claroc, a cybersecurity research firm, tested Grok Build, a feature that lets people build apps by describing them in a chat window. The tool comes from SpaceXSI, the company that combines SpaceX and Elon Musk's AI venture xAI. Claroc found 35,578 of these apps open to anyone with no login, out of 37,571 it checked. Some were built by SpaceX and X's own employees, including a sales map covering 594 customer accounts and ad proposals, one of them addressed to a U.S. federal agency.

The cause is simple. Each app Grok builds gets its own web address, and by default that address is open to anyone who finds the link, not just the person who made it. Claroc estimates that 650 to 800 of the open apps exposed other people's private data, including patients' medical records and employee passwords stored in plain, readable text. Building an app from a few chat prompts turns out to be easy. Keeping it private does not happen by default.