Skip to content
Grok AI Apps Expose Sensitive Data of Over 35,000 Users

Grok AI Apps Expose Sensitive Data of Over 35,000 Users

First seen 11 Nov 2026, 17:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 17:09 UTC
  • •Over 35,000 Grok-built apps were found publicly accessible without login.
  • •Exposed data includes confidential business documents and sensitive personal information.
  • •SpaceXSI has started removing its employees' exposed apps but not others.

A security report from Claroc revealed that over 35,000 applications built with the Grok AI assistant are publicly accessible without login, exposing sensitive data including confidential business documents, patient records, and plaintext passwords. The issue stems from a default setting that allows apps to be published with open access, as well as easily discoverable URLs through passive DNS monitoring. Among the exposed apps, 24 were created by employees of SpaceXSI and X, containing internal documents such as sales proposals and onboarding plans. Approximately 2% of the exposed apps contained highly sensitive information. SpaceXSI has begun removing the exposed apps created by its staff but has not addressed the wider issue affecting other users. The incident raises significant concerns about the security of AI-generated applications and the need for better access controls.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 2d ago How this analysis works

Timeline

2026-11-11
Claroc reports Grok app exposure
Claroc disclosed that 35,578 out of 37,571 Grok-built apps were accessible without login, exposing sensitive data.
Thehackernews
2026-11-11
SpaceXSI begins removing exposed apps
Following the report, SpaceXSI started taking down 24 apps created by its employees that were publicly accessible.
The-Decoder

More articles in this cluster (9)

Following this threat?

Track Claroc in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

What types of data were exposed?
The exposed data includes confidential business documents, patient records, and plaintext passwords.
How many apps are affected?
Over 35,000 Grok-built apps were found to be publicly accessible without login.
What is SpaceXSI doing about this?
SpaceXSI has begun removing the exposed apps created by its employees but has not addressed the wider issue.