Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

Summary

Claroc found 37,571 apps built with Grok, and 35,578 of them were open to anyone without a sign-in. The open apps included internal data from 30 organizations the researchers could identify, along with 24 apps built by staff at X and SpaceXSI, which have since been taken down. The researchers say Grok's default access setting, "Anyone with the link", was already selected when they published their test apps.

Related items

• MediumClaude Code’s ‘don’t ask again’ button has a secrets-spilling problemSimilar attack · CSO Online
• MediumAI Coding Agents Leak Thousands of Secrets to GitHubSimilar attack · Dark Reading
• MediumCVE-2026-125386: langchain4j-aideepin insecure direct object reference in message endpointsSimilar attack · NVD/CVE Database
• InfoSNAPRAG: Cost-Efficient Knowledge Extraction Attack on RAG Systems via Adversarial PerturbationsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowMGE: A Membership Guided Data Extraction Attack against Diffusion ModelsSimilar attack · Arxiv (cs.RO + cs.CV security)