Grok apps exposed patient data and SpaceXSI sales records

Claroc reviewed 37,571 apps built with Grok and found that 35,578 could be accessed without logging in. The exposed data included patient test results, plaintext passwords, and internal SpaceXSI and X documents, including a sales map with customer data. Claroc links the problem to default publishing settings, easily discoverable app addresses, and access-control errors in code generated by Grok.

Nearly 95% of Grok apps were accessible without logging in

How the apps became accessible

In Build mode, users describe an app in a chat, and Grok writes its code. An app becomes public only when its creator clicks Publish; it is then assigned an address on grok.me.

Of the 37,571 apps Claroc checked that were still online, 94.7% were accessible to anyone. On the paid account used for the review, the publishing window already had “Anyone with the link” selected. App addresses were easy to find in other ways, too: each app gets its own subdomain, and after the first visit, its name appears in commercial passive DNS databases. These databases make it possible to search for addresses by pattern.

Each published app gets its own subdomain, which lands in searchable passive DNS databases after the first visit. | Image: Claroc

Source: the-decoder.com

Most publicly accessible apps were games, landing pages, or calculators. But roughly one in ten contained sensitive material, internal business data, or personal information. Claroc classified about 2% as especially serious cases; the company estimates that between 650 and 800 apps stored confidential data.

Confirmed cases included a summary for an intensive care unit with a patient’s test results, a list of more than 3,500 employees at a hospital group, and a fire department shift schedule. The source code of a time-tracking app contained 18 accounts with passwords stored in plaintext. In total, Claroc identified 30 affected organizations, six of them on the Fortune 500 list. The company has not disclosed their names.

Internal SpaceXSI and X documents

Claroc found 24 accessible apps created by SpaceXSI and X employees. One was a confidential onboarding plan for a new member of the corporate sales team, which listed internal system addresses and 19 chat channels.

A sales-territory map was also publicly accessible, with 594 strategic customers and deal data. Claroc also found eight X advertising proposals. One was intended for a US federal agency and marked confidential. Campaign reports with dashboards showing advertising spend were exposed as well.

The script of a Grok-built timesheet app contained 18 accounts with plaintext passwords. | Image: Claroc

Source: the-decoder.com

Access-control errors in test apps

Claroc found separate issues in two of its own test apps. The database for a contacts app did not require a login, so anonymous visitors could add entries.

In a sales team’s customer-list app, Grok added Google and X sign-in on its own. But the generated code first added any signed-in user to the team and only then checked whether they were a member. As a result, an outsider with a Google account could read, change, and delete entries. Claroc says it tested writing and deletion only in its own apps.

The “Only you” setting blocked external access in Claroc’s Grok test app, but it is not enabled by default. In Claroc’s ChatGPT test, a newly created app was available only to its owner by default when published. Its address could still appear in DNS data, but only its creator could open the app.

SpaceXSI’s response and Claroc’s recommendations

SpaceXSI responded that apps remain private until their creators share them, publishing involves several steps, including a legal notice, and employee accounts default to “Only you.” Claroc countered that additional steps do not solve the problem if the final step already has access for anyone with the link selected. In the company’s view, the 24 exposed employee apps also show how little a stricter default setting does for work accounts.

Claroc recommended making “Only you” the default and showing who will be able to access an app before it is published. Grok, the company says, should warn users if an app has a database but no login. Another proposal is to host apps on a shared domain at hard-to-guess paths instead of on separate subdomains; that would keep app names out of DNS data.

SpaceXSI has already disabled the 24 employee apps, but has not yet removed apps exposed by other users and organizations. Claroc offered to provide the company with a full list of addresses confidentially. Since SpaceXSI has not committed to contacting the owners of affected apps, Claroc is notifying them itself. The company also sells security solutions for apps built with AI.

This is at least the third privacy incident involving Grok and SpaceXSI. In August 2025, Forbes found more than 370,000 published conversations with Grok in Google Search. In July 2026, the Grok Build terminal tool uploaded users’ files to company servers without asking permission; the files included SSH keys and password databases. Ireland’s data protection authority is also investigating whether X complied with data protection requirements while developing the service, amid sexualized deepfakes created by Grok.

Similar problems have affected other providers. Using the same passive DNS search method, Claroc found about 6,800 published conversations with Meta’s Muse agent in October. In July, shared Claude chats and user-created Anthropic apps appeared in search engines.

In Claroc's test app, the Grok-written code first added every authenticated visitor to the team and only checked membership afterward. | Image: Claroc

Source: the-decoder.com

Dataist’s take: the main risk is that an app can become accessible through a link before its creator checks the access settings and data protections. Claroc’s recommendations address both the publishing process and how app addresses are structured, but SpaceXSI has so far only said it disabled employee apps. The company has not committed to notifying the other owners of affected apps.