Claroc finds Grok-built apps exposing patient data, plaintext passwords and SpaceXSI sales pipeline

Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline

Security firm Claroc checked 37,571 Grok-generated apps that are still online. Of those, 35,578 could be opened without logging in, exposing patient records, plaintext passwords and SpaceXSI internal sales data. Claroc traces the leaks to default sharing settings and broken permission checks.

Why it matters: Claroc traced the exposure to default sharing settings and permission-check bugs, and outside accounts could read, change and delete team data after logging in.