Originally published on The Daily Flare.
Grok disputed Ars Technica’s account on November 11, saying the findings concerned grok.com’s app-builder feature, not Grok Build, after Claroc identified tens of thousands of publicly reachable apps.
Security firm Claroc found 43,601 app addresses associated with Grok Build and said 35,578, or 94.7 percent, could be opened without authentication. Ars Technica reported the findings on November 10. The accessible apps did not all contain sensitive material, but Claroc estimated that about one in 10 held internal or sensitive information and roughly 2 percent contained data serious enough to receive a high or critical severity rating.
Claroc said the addresses used four randomly generated words, intended to make them difficult to guess. But the researchers found that passive DNS services, which record and index domain names observed in DNS traffic, could reveal the addresses. Ars reported that clicking a discovered link generally opened the app and its associated data, except in rare cases.
Claroc also found that “Anyone with the link” was the default sharing choice when users published apps. The other available options were “Invited Users” and “Only You.” The firm said that default left projects accessible to anyone who found their address, even if the creator had not directly shared it with that person.
Among the exposed projects were 24 apps made by SpaceXSI staff, the company formed by the merger of SpaceX and xAI. Claroc identified a confidential onboarding plan for a new enterprise sales team member, a map covering 594 sales accounts, internal addresses for sales tools, and advertising proposals. Other material included advertiser account boards, campaign reports and an X brand-safety playbook, according to Engadget’s account of the research.
Claroc said it was surprised to find the company behind Grok had left its own internal material open. “We were shocked,” the security firm wrote in a Tuesday post. It said it notified SpaceXSI on Sunday. After Claroc tagged Elon Musk and Grok manager Matt Palmer on X, Ars sent questions to the company. SpaceXSI removed the links to its 24 apps within hours of Ars’ inquiry; the links then returned an “app not found” error.
The findings also included information associated with other companies and organizations. Claroc identified a hospital staff directory listing about 3,565 employees, a Peruvian construction company dashboard containing 3,784 worker medical exams, and a Tesla service-center scorecard naming 22 technicians and showing productivity and bonus status. Other exposed material included a roster of 108 people working on a US Navy logistics support contract and a luxury cruise-line galley checklist listing crew members by name and employee ID.
Business records in the exposed apps included a confidential proposal by a US IT services company to a retail customer, with a hardware bill of materials; a home construction sales sheet with about 583 prospective buyers and notes on budgets and financing; and an auto transport quote desk containing about 4,000 orders, prices and margins. Claroc also found project figures for 37 developments at a Malaysian holding company and a loading procedure for an explosives building at a US plant belonging to a Norwegian-Finnish aerospace and defense group.
TechRadar reported that one exposed employee timesheet included downloadable code containing 18 plaintext account passwords, including administrator credentials. Claroc said six of the organizations it identified were Fortune 500 companies and 26 had more than 1,000 employees. The research also uncovered apps containing recruitment information and healthcare records.
In its November 11 response, Grok called the Ars article “incorrect,” saying it referred to the “app builder feature on grok.com, not Grok Build.” The company also said users review sharing settings and receive a warning before publishing apps. Claroc said that, at the time of its report, apps belonging to other users and organizations remained accessible after SpaceXSI removed its own.
Top comments (0)