Grok Build exposed over 35,000 apps accessible without login, involving some corporate secrets and medical records

Odaily: Security research firm Claroc found that of the 37,571 online apps created with Grok Build, 35,578 (about 94.7%) could be accessed without logging in, with an estimated 650 to 800 apps involving private or sensitive data. The exposed information includes internal corporate documents, medical records, employee information, and plaintext passwords, involving 6 Fortune 500 companies.

Among them, 24 apps were created by employees of Musk's SpaceXSI and X, involving internal sales plans, customer materials, and confidential advertising proposals for U.S. federal agencies. The researchers noted that Grok app sharing links could be discovered through DNS records, and some apps lacked access controls. Currently, SpaceXSI has taken down the 24 apps involving itself, but related apps created by other users remain accessible.