Today for AI
HOT RADAR
industryHEAT 11.5°

AI CURATED HOT STORY · 11/12/2026

Grok Build Apps Expose 35,000 Unauthenticated Endpoints

1 reports archived1 independent sourcesupdated 11/12/2026, 18:08:24
Synthesis & Latest Updates
1 Sources Cross-Validated

Security firm Claroc found that over 35,000 apps built with Grok are accessible without authentication, with roughly 650 to 800 containing private data, including internal sales tools and employee performance records from SpaceXSI, X and Tesla, plus ICU patient records and plaintext credentials. The root cause is that Grok assigns each app a hard-to-guess random subdomain but relies on obscurity rather than real access control. Apps created by SpaceXSI and X employees have been taken offline, while many third-party apps remain exposed.

LATEST/Security firm Claroc found that over 35,000 apps built with Grok are accessible without authentication, with roughly 650 to 800 containing private data, including internal sales tools and employee performance records from SpaceXSI, X and Tesla, plus ICU patient records and plaintext credentials. The root cause is that Grok assigns each app a hard-to-guess random subdomain but relies on obscurity rather than real access control. Apps created by SpaceXSI and X employees have been taken offline, while many third-party apps remain exposed.

Hourly heat curve

3 fully observed hours
Now
11.5
Peak
11.819:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. 量子位官网T2·78 pts

    Grok Build Apps Expose 35,000 Unauthenticated Endpoints

    • Claroc tested 43,551 Grok Build app URLs and found 94.7% of online apps open without login
    • Roughly 650-800 apps held private data, affecting SpaceXSI, X, Tesla and six Fortune 500 firms
    • Leaked data includes ICU lab results and ventilator records, 18 plaintext account passwords, and employee bonus scorecards
    • Root cause is random subdomains providing obscurity rather than access control; unclear whether the platform will notify affected customers