What happened
QbitAI reports that security firm Claroc found more than 35,000 Grok Build apps accessible without login, with an estimated 650–800 containing private data. Examples included SpaceXSI and X sales information, Tesla employee performance and bonus details, ICU patient records, and plaintext passwords. Claroc said passive DNS databases could reveal app URLs; Ars Technica reported that 24 apps created by SpaceXSI and X employees had been taken down by publication time.
Why it matters
The report traces how passive DNS records made Grok Build apps discoverable and compares link access with ChatGPT’s default sharing setting, clarifying how obscured URLs differ from access control.