Grok Build Coding Tool Left 35,578 Apps Publicly Accessible Without Login

A serious security flaw has been found in the “Grok Build” coding tool from “SpaceXSI,” the company formed by the merger of Elon Musk’s “SpaceX” and “xAI.” The service, which creates web apps based on descriptions entered by users in a conversational format, left thousands of projects publicly accessible online. As a result, business documents, medical information and passwords were accessible to outsiders. The problem involved the apps’ default sharing settings and how easily their addresses could be found.

“Grok Build” generated a “grok.me” address consisting of 4 random words for every published app. Because these words appeared at the beginning of the address, passive DNS services that record internet addresses could list them. Security experts identified 43,601 addresses using this method. Although the addresses were generated randomly, they could be found in public databases. Therefore, not sharing the link with anyone did not mean the app would remain private.

Testing found that 35,578 apps could be opened without logging into an account. The study reported this figure as 94.7 percent. The service offered 3 sharing options: anyone with the link, invited users and only the app’s owner. The default option gave anyone with the link open access. Internal data was found in approximately 1 out of every 10 apps. Material posing a high or critical risk was found in 2 percent of the apps.

The exposed data included a list of hospital employees containing more than 3,500 names and a document concerning intensive care patients. Employee information from a fire department and a recruitment database from a freight company covering more than 1,000 people were also leaked. The downloadable code of another document contained 18 account passwords written in plain text. These included login credentials for administrator accounts.

In 24 publicly accessible apps developed within “SpaceXSI,” researchers found onboarding plans, employee lists and a sales map of 594 strategic accounts. The leaked materials included 8 advertising proposals and a management dashboard for 4 active advertiser accounts. Also left publicly accessible were 2 copies of the “X” brand safety guidelines and 7 campaign reports. A budgeted advertising document prepared for a US federal agency was marked confidential. Only 1 of the apps found asked users for a password.

The leaked data did not belong only to small organizations. The victims included 6 companies on the “Fortune 500” list and 26 organizations with more than 1,000 employees. In 1 of the 2 test apps created by the experts, a person who had not logged into an account could modify a shared contact database. In the other, any “Google” account automatically received access without being a team member.

The researchers notified “SpaceXSI” about the security flaw on November 8. The company took action after Elon Musk and other executives were tagged on the “X” platform. It shut down its own 24 apps within 2 days and began sending separate warnings to the owners of other publicly accessible apps. However, when the study was published, some apps belonging to other users and organizations were still publicly accessible.