Skip to main content
EnterpriseSecurity

Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline

Source: The Decoder (opens in a new tab) · Jonathan Kemper

Intel Summary

Security firm Claroc discovered that more than 35,000 applications built with Grok were publicly accessible without authentication, exposing plaintext passwords, patient records, and confidential corporate sales documents. The exposure stemmed from an insecure default configuration where access was set to 'Anyone with the link'. While SpaceXSI removed 24 internal employee apps, the remaining exposed applications reportedly remain online.

Why It Matters

Insecure default permissions in generative AI app builders create immediate enterprise compliance and privacy risks, leading to severe data leakage without requiring direct system compromise. Organizations deploying apps on the platform must audit and remediate their access controls immediately to prevent unauthorized data harvesting.

Organizations & Entities

Topics