Claroc: over 35,000 Grok Build apps open without sign-in, exposing patient data and internal company documents

Security firm Claroc says it tried 43,551 Grok app addresses; 37,571 were online and 35,578 (94.7%) opened for anyone with no sign-in, and in its account Grok Build proposed "Anyone with the link" at publish ^[1][2]. Claroc says 24 open apps were built by SpaceXSI and X staff and others held internal data from 30 identifiable organizations, including an ICU briefing for a single patient and a hospital group roster of more than 3,500 employees; Anquanke reports an estimated 650 to 800 apps held private data ^[1][2]. What to do now: Claroc advises that any Grok app holding internal data be set to "Invited users" or "Only you", that a stranger get an error page, and that apps nobody owns be unpublished ^[1].

Organisations running: SpaceXSI Grok Build (grok.me published apps)

1. Set any Grok app holding internal data to "Invited users" or "Only you" and confirm a stranger gets an error page .