Overview
- Claroc Research published a report on November 10 that found 35,578 of 37,571 live Grok Build apps were accessible without signing in, a roughly 94.7% exposure rate.
- Researchers enumerated grok.me subdomains by scanning 43,551 addresses and using passive DNS, showing that randomized four-word subdomains can be discovered and are not a substitute for access controls.
- Among the exposed apps were 24 built by SpaceXSI and X staff containing onboarding plans, sales maps and a confidential advertising proposal for a U.S. federal agency, and roughly 30 other organizations had internal files open.
- Claroc estimated 650–800 apps likely held potentially sensitive material, including hospital staff rosters, an intensive care briefing, and timesheets with plaintext passwords, which could trigger privacy and procurement scrutiny.
- SpaceXSI removed the 24 staff apps after notification but has not publicly remediated the wider set of open user apps, and Claroc has urged changing the default to 'Only you', adding organization-domain restrictions, and notifying affected organizations.