Grok Build flaw exposed thousands of apps and confidential data

Researchers found 35,000 Grok Build apps open to the public because of a flaw in the coding agent’s links.

The exposed apps included material from SpaceXSI, a hospital group, a fire department and other companies.

Some SpaceXSI files included sales plans and advertising materials, including account boards and a brand safety playbook.

Grok Build put random words in its app links, but placed them in a way that allowed passive DNS services to find and record the links in searchable databases.

That made confidential apps discoverable without permission, although not every exposed app held sensitive information.

Claroc estimated that roughly 2 percent of the material it found was serious enough to rate high or critical.

SpaceXSI removed 24 of its own exposed apps, but Claroc said other users and organizations had not all done the same.