622/69 Thursday, November 12, 2026
Cybersecurity company Claroc has published findings from an investigation into applications created through SpaceXSI’s Grok Build feature. Of 37,571 applications that remained active on the platform, 35,578, or 94.7%, were accessible to the public without authentication. The exposed applications included 24 created by employees of X and SpaceXSI themselves, as well as internal information belonging to at least 30 other organizations across sectors including construction, energy, and healthcare, six of which were Fortune 500 companies. Researchers estimated that roughly one in ten of the exposed applications contained business or personal information, while around 2% contained sensitive data classified as high to critical risk.
The primary cause of the exposure was the default publishing configuration, which allowed applications to be accessed by “Anyone with the link.” The applications were also assigned subdomains under grok.me, causing their subdomain names to appear in Passive DNS databases that could be searched and enumerated by third parties without prior knowledge of the original links. The research team also found weaknesses in AI-generated authentication code that could allow uninvited external accounts to access, modify, or delete database records. Exposed information reportedly included hiring plans, confidential sales territory maps and advertising proposals belonging to X, more than 3,500 healthcare personnel records, information relating to critically ill patients, fire department staffing schedules, and employee time-tracking systems that stored passwords in plaintext within application code. Following notification, SpaceXSI removed all 24 applications created by its own employees, while applications belonging to other users and organizations reportedly remained accessible.
To reduce the risk of data exposure, organizations and system administrators should review the use of AI-based application development platforms within their environments, including Grok, Lovable, Replit, v0, Bolt, Base44, and Google AI Studio, which employees may be able to use without formal IT provisioning. Where Passive DNS data is available, organizations should use it to identify applications created under domains associated with these services and verify that applications containing internal information are restricted to invited users or owners only, returning an HTTP 401 response when accessed by unauthorized parties. Organizations should also test authentication controls using external accounts, review application code and scripts for embedded names, email addresses, passwords, or other sensitive information, and immediately unpublish applications that are no longer actively maintained or required.
Source: https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html