Researchers found Grok Build apps were widely exposed due to insecure default sharing settings and discoverable URLs
Thousands of accessible apps leaked sensitive business data, healthcare records, passwords, and internal documents
SpaceXSI remediated the issue after disclosure, highlighting security risks in AI-generated application platforms
Grok Build, an AI-powered coding agent built by Elon Musk’s SpaceXSI, has been found leaking a mind-numbing amount of confidential data, thanks to an apparent misconfiguration in how the products are being published on the platform. SpaceXSI, established when SpaceX and xAI merged , has a product called Grok Build, which allows users to create web applications by simply describing what they want in a chatlike interface. Without having to write any of the code themselves, the users can have an app ready in minutes and publish it directly from the chat interface. The app gets a unique web address in the format . grok. me, where “name” usually consists of four random words. It is something of a privacy feature, to make sure people can’t just guess an app’s location easily. But according to security researchers Claroc, these addresses can be found through passive DNS services, which collect and index domain names observed in DNS traffic. In other words, anyone can find a published app even if their creator (or no one else, for that matter) ever shared a link for it. As Claroc explained in its report, the researchers did just that, identifying 43,601 addresses under grok. me. Unlocked apps
But finding someone’s app shouldn’t be a big deal, right? These apps are all password-protected, right? Well, wrong. The researchers found that almost all of the apps (35,578, or 94. 7%) could be accessed without authentication. That means that whatever data they were holding and generating could be accessed with almost no trouble at all. Further investigation uncovered a major oversight – when users want to publish an app, they are offered three privacy choices: “Anyone with the link”, “Invited Users”, and “Only You”…