[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-35578-grok-build-apps-were-open-to-anyone-who-found-them":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12880,"35578-grok-build-apps-were-open-to-anyone-who-found-them","35,578 Grok Build Apps Were Open to Anyone Who Found Them","Researchers found most of 43,601 published Grok Build apps needed no login, and the default sharing setting was the widest one on offer.","Most of the 43,601 apps published through SpaceXSI's Grok Build could be opened by anyone, with no login, according to researchers at Claroc.\n\nGrok Build lets users describe an app in a chat-style interface and publish it from the same window, without writing code. Each app gets an address made of four random words under grok.me, which works as a privacy measure because nobody can easily guess it. Claroc found the addresses anyway, using passive DNS services, which index domain names observed in DNS traffic. An app was discoverable even if its creator never shared the link. Of the 43,601 addresses the researchers identified, 35,578 could be accessed without authentication.\n\nPublishing offers three choices: \"Anyone with the link\", \"Invited Users\" and \"Only You\". Claroc said the first is the default.\n\nMost of what the researchers found was harmless, such as games, calculators and landing pages. But one in 10 apps held sensitive or internal business information, and 2% exposed material serious enough for a high or critical severity rating. Examples included a hospital employee directory with more than 3,500 names, an intensive care briefing with patient information, and a trucking company's recruitment database of more than 1,000 people. One employee timesheet app had downloadable code containing 18 accounts with plaintext passwords, administrator credentials among them.\n\nSpaceXSI's own material leaked too. Claroc found 24 open apps holding onboarding plans, employee name lists, a sales territory map of almost 600 strategic accounts, and media plans with budget tiers, including one for a US federal agency marked confidential. Only one app asked for a password, an archive of a streaming service's ad measurement studies.\n\nClaroc also built two test apps. One let unauthenticated visitors modify a shared contact database. The other granted access to anyone who signed in with a Google account, whether or not they belonged to the team.\n\nThe researchers notified SpaceXSI on November 8, and within two days its own apps were no longer available. Notification of other app owners is under way.\n\nA random address is an unguessable name, not a lock, and publishing it to a public DNS record turns it into a listing. The sharing menu resembles the one in Google Docs, but a shared document is mostly text, while these apps held databases and code. That raises a question for any chat-to-app tool: who checks the sharing settings when the person publishing never wrote the app?","[\"grok-build\",\"data-exposure\",\"ai-coding\",\"spacexsi\"]","2026-11-11T17:15:00.000Z","2026-11-11T18:58:25.935Z","2026-11-11T18:58:26.154Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Fix three problems: (1) the numbers don't reconcile, because 35,578 of 43,601 is about 81.6%, not 94.7%, so either flag the discrepancy or avoid the percentage; (2) cut the leftover meta-commentary 'The source does not say whether the default has changed' and either find the answer or drop the line; (3) stop attributing the Google Docs comparison to the researchers, since the source material doesn't show they drew it, and trim the unsupported analysis asides.","resolved","security",[32,33,34,35],"grok-build","data-exposure","ai-coding","spacexsi",[37],{"name":38,"url":39},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Felon-musks-grok-build-coding-agent-is-leaking-a-serious-amount-of-confidential-data",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]