Claroc says Grok Build exposed more than 35,000 apps
Security firm Claroc says it found more than 35,000 Grok Build apps accessible online, containing medical and business data. They included 24 SpaceXSI projects, whose links were removed after Ars Technica contacted the company.
Security firm Claroc says it found more than 35,000 apps created with Grok Build accessible online. The projects exposed information including medical exams, business plans, advertising proposals, employee names and identification numbers, as well as data connected to Fortune 500 companies and organizations in the health, defense and infrastructure sectors, Ars Technica and Tecnoblog report.
The issue reportedly stemmed from a combination of predictable links, recorded in public DNS databases, and a default setting that allowed anyone with the address to access an app. Claroc also found 24 SpaceXSI apps, including a confidential onboarding plan, a map covering 594 accounts, internal system addresses and advertising proposals. The security firm says it notified SpaceXSI, which began removing the links within hours after Ars Technica sent questions; all 24 projects then returned an “app not found” error.
Why it matters · editorial interpretation
The case suggests that default settings and predictable URLs can expose data entered into AI applications, including information linked to companies and sensitive sectors. The removal of SpaceXSI projects after questions from Ars Technica also highlights the importance of a rapid response when an exposure is identified.
Sources: Ars Technica, Tecnoblog