35,000+ Grok-Built Apps Exposed, Some Leaking Sensitive Data
Security firm Claroc found that 35,578 of 37,571 apps built with Grok's app builder were open to anyone without signing in, and about one in ten held business or personal data.
⚡ Why it matters
AI makes it easy to build an app in minutes, but default sharing settings can expose company data to the world. A 'secret' link is not really secret.
Grok can build a working app from a text description in chat, a feature opened to all plans on August 19. Each published app gets a grok.me subdomain, and its creator decides who can open it.
What the researchers found
- The bulk were simple games, calculators and landing pages, yet roughly 10% held business or personal data and roughly 2% contained high or critical material.
- They included 24 apps built by staff at X and SpaceXSI (formerly xAI), with a confidential hiring plan and a sales map of 594 accounts. The company removed the staff apps but not other users' apps.
- Apps exposed data from 30 other organizations, 6 of them Fortune 500 firms. Examples include a hospital group's list of 3,500+ employees, a fire department's shift board and code holding every employee's password in plain text.
Why they were exposed
At publish time, "Anyone with the link" was preselected. App addresses do not stay private, because opening one triggers a DNS lookup that passive DNS services record and let subscribers search.
Lessons for AI app builders
- Choose "Invited users" or "Only you" for any app with internal data.
- Never put passwords or customer data in app code.
- Companies should set a clear policy for vibe coding tools and review what staff publish.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.