AI Platform Grok Build Exposes Thousands of Private Records
Security researchers found that over 35,000 apps created on the AI platform were left exposed online without any authentication.
The Scale of the Vulnerability
The popular AI-powered application development platform, Grok Build, has revealed a significant security flaw. According to research by cybersecurity firm Claroc, more than 35,000 apps built on the platform were publicly accessible on the internet without any form of authentication. This meant that anyone with the correct web address could access confidential information belonging to both private individuals and major organizations.
Scope of the Problem and Exposed Data
During their investigation, specialists examined over 43,500 URLs and discovered that nearly 95% of the live applications required no password or additional protection. While the majority were simple games or calculators, approximately 10% contained sensitive business or personal data. This included hospital staff lists, patient laboratory results, and internal fire department schedules. In one instance, the application code contained 18 hardcoded passwords that were visible to any visitor.
Responsibility of SpaceXSI
Even applications created by employees of SpaceXSI, the developer of Grok Build, were found to be unprotected. These included a strategic sales map and confidential advertising proposals intended for U.S. federal agencies. Following the publication of Claroc’s report, SpaceXSI immediately took its own applications offline, though data from other platform users remained exposed for a period.
Company representatives maintain that applications are secure by default and only become public if the creator chooses that setting. However, researchers point to a systemic issue: when publishing an app, the system automatically suggests an "accessible to everyone" setting, which confuses inexperienced users.
Why This Is Dangerous
Grok Build applications use specific web addresses that are easily indexed by search engines and DNS services. As a result, these apps can be discovered online without any special effort. While other platforms face similar issues, Claroc estimates that the Grok Build case involved the highest volume of critical and business-threatening data.
These events highlight the urgent need for security in AI tools. It is essential for users to verify privacy settings whenever creating an application. Claroc is urging SpaceXSI to make "private" access the default and automatic setting for the platform to prevent future leaks.