Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords

Cybersecuritynews •Abinaya • November 11, 2026

Researchers found that apps built with Grok’s app builder are open to Anyone online. Thousands of these apps hold private business data, staff details, plain-text passwords, and patient information. No hacking was needed to reach them. Grok’s Build mode creates and publishes chat-generated apps under grok.me, while its parent company, SpaceXSI (formerly xAI), did not […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Grok AI Apps Expose Sensitive Data of Over 35,000 Users A security report from Claroc revealed that over 35,000 applications built with the Grok AI assistant are publicly accessible without login, exposing sensitive data including confidential business documents, patient records, and plaintext passwords. The issue stems from a default setting that allows apps to be published with open access, as well as easily discoverable URLs through passive DNS monitoring. Among the exposed apps, 24 were created by employees of SpaceXSI and X, containing internal documents such as sales proposals and onboarding plans. Approximately 2% of the exposed apps contained highly sensitive information. SpaceXSI has begun removing the exposed apps created by its staff but has not addressed the wider issue affecting other users. The incident raises significant concerns about the security of AI-generated applications and the need for better access controls. 6 sources 69

Extracted Entities

Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Domains (1)