Security Research Institute: Over 35,000 Grok Apps Publicly Accessible, Exposing Corporate Secrets and Personal Privacy Data

On November 12, security research firm Claroc Research disclosed that it scanned 43,551 Grok application addresses and found 37,571 still online, with 35,578 (approximately 94.7%) accessible without login, leaving some applications vulnerable to sensitive information leakage.

The researchers found that 24 public applications created by Grok developers and X employees contained internal sales plans, client profiles, and advertising proposals marked as confidential. Additionally, internal data from 30 institutions appeared in public applications, including medical information, employee lists, and plaintext passwords.

Claroc noted that the access permission settings applied upon the release of Grok applications, along with the authentication mechanisms for some AI-generated applications, contained security vulnerabilities. After the researchers reported the issues to the relevant companies, those companies subsequently took down the 24 applications created by their employees, but related applications from other users have not yet been comprehensively addressed.