GhostShares 2: Grok apps exposed xAI's business secrets and people's private data
BLOG.CLAROC.IO
EXPOSED
SUMMARY

Researchers found over 35,000 Grok apps on grok.me that opened to anyone with the link, including 24 internal SpaceXSI and X apps exposing confidential sales and onboarding data; about 10% held sensitive information.

Grok’s default publishing was “Anyone with the link,” and some apps let visitors change data because sign-in checks were inadequate. “AI app builders turned publishing into a few clicks, and the default answer to who can see it is everyone,” said Asaf Aprozper of Claroc Research.

Researchers urged making “Only you” the default and adding organization-only access; SpaceXSI said employee accounts default to Only you.

Your call

What do you think

Should AI app builders make 'Only you' the default for published apps?

One tap. No account.

Advertisement
Scroll to continue reading