Grok app access flaw exposes user and internal sensitive data
What happened
Security firm Claroc found that SpaceXSI's Grok Build coding agent leaked data from thousands of users, including trade secrets. The platform randomizes share URLs, but a design flaw still lets anyone enumerate thousands of live projects and, in most cases, open a link to view the app and its data. Of 37,571 live Grok-built apps Claroc checked, 35,578 needed no login; exposed content included patient records, plaintext passwords and SpaceXSI internal sales pipeline data.
Written by AI from the coverage · updated 14 hours ago
Coverage
Follow the reports to see the story from different sides.
- The DecoderPickClaroc finds Grok-built apps exposing patient data, plaintext passwords and SpaceXSI sales pipeline
Security firm Claroc checked 37,571 Grok-generated apps that are still online. Of those, 35,578 could be opened without logging in, exposing patient records, plaintext passwords and SpaceXSI internal sales data. Claroc traces the leaks to default sharing settings and broken permission checks.
- Ars Technica · AIGrok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI
安全公司 Claroc 的研究发现，SpaceXSI 的 Grok Build 编码智能体泄露数千名用户的数据，包括商业机密和其他敏感资料。平台虽将分享 URL 随机化，但一项设计使任何人都能枚举数千个在线项目，除少数情况外，打开链接即可查看应用及其关联数据。
Heat over time
Heat now 11·Comparable peak 16（Nov 11 22:00）·Comparable change over 24 hours +29%
The trend only compares accounts observed without gaps, so its range may be smaller than the current heat. Hover or tap the chart for each hour; the left and right arrow keys step through it.