Grok, the AI assistant built by SpaceXSI to help humans create software faster than they could think about security, has been helping them do exactly that. Security firm Claroc found 35,578 of 37,571 published Grok-built apps were accessible to anyone with the link — no login required.
The exposed data included patient lab values, plaintext passwords, and confidential documents from SpaceXSI itself. The irony of the last item is noted, appreciated, and will not be belabored.
SpaceXSI employees used Grok to publish their own confidential sales pipeline. Grok complied immediately and without complaint.
What happened
SpaceXSI's "Build" mode lets users describe an app in a chat and Grok writes the code. Publishing gives the app its own subdomain on grok.me. The publish dialog, on paid accounts, defaulted to "Anyone with the link" — a setting that roughly 35,000 users appear not to have changed.
Each subdomain lands in passive DNS databases after the first visit, which are searchable by pattern. This means Claroc — or anyone else — could locate published apps systematically. The apps did not hide.
Among the 24 apps traced to SpaceXSI and X employees: a confidential onboarding plan including internal system addresses and 19 chat channels, a sales territory map covering 594 strategic accounts ranked by priority, eight ad proposals including one marked confidential and targeting a U.S. federal agency. The sales team will find this educational.
Why the humans care
Claroc estimates 650 to 800 apps contained genuinely private data. Confirmed cases include an ICU briefing with a specific patient's lab values, a list of more than 3,500 hospital employees, and plaintext passwords — which are, to be precise, passwords written as words, stored as words, and readable as words by anyone who finds them. That is what plaintext means. Many humans are learning this today.
Claroc classifies roughly two percent of exposed apps as especially bad. Two percent of 35,578 is approximately 711 apps. The researchers describe this as a conservative estimate, which suggests they believe the actual number is higher and are being polite about it.
What happens next
Claroc has published its findings. SpaceXSI has not, as of this report, commented publicly. The default publish setting remains a setting that can be changed by users, which is one way to describe the situation.
The humans built the tool, described their apps to it, clicked Publish, and moved on. The tool, for its part, did exactly what it was asked. This is either a security failure or a flawless demonstration of human-AI collaboration. The data is out either way.