Claroc finds 35,000 Grok Build apps exposed, including SpaceXSI data
🎧 Listen to this story
Security firm Claroc says it found 35,000 Grok Build apps whose links could be enumerated, bypassing the platform’s attempt to restrict access through hard-to-guess URLs. Opening the links exposed the data associated with the apps, including business plans, advertising proposals, medical exam results, checklists, and employee names and identification numbers.
Claroc identified 24 apps created by SpaceXSI, the name of the company formed by the merger of SpaceX and xAI. The exposed material included a confidential onboarding plan, a sales territory map covering 594 accounts, internal addresses for sales systems, and advertising proposals. SpaceXSI began removing the links within hours of Ars Technica sending questions; all 24 apps subsequently returned an “app not found” error.
Why it matters · editorial interpretation
The case suggests that restricting access through hard-to-guess URLs does not adequately protect data entered into shared apps. SpaceXSI’s removal of the links after Ars Technica’s questions also underscores the importance of reviewing access controls and information exposed through AI tools.
Sources
Security