Grok-built apps left open to anyone, exposing patient data and SpaceXSI sales files
Source The Decoder
At a glance
Security firm Claroc checked 37,571 web apps built with Grok and found that 94.7% could be opened without logging in. The exposed material included patient lab values, plaintext passwords, and internal sales files from SpaceXSI.
Key points
The default publishing setting was 'anyone with the link'.
App addresses were easy to find through public DNS records.
24 apps came from SpaceXSI and X employees and held internal sales maps and ad proposals.
Some apps held sensitive data such as patient lab values and hospital staff lists.
Why it matters
AI-built apps can quietly expose personal data and company secrets to anyone, so creators and users need to check publishing settings carefully.
Original article
Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline
The Decoder · Nov 11, 2026, 9:53 PM GMT+9 · the-decoder.com
Read on The DecoderAI read the original article and summarized it in plain language. It may contain mistakes, so please check the original for accuracy. The article's copyright belongs to The Decoder.