Veriwire
← Back to the wire

Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline

AnnouncementProductNov 11, 2026

Security firm Claroc found that 94.7 percent of 37,571 online apps built with Grok were publicly accessible without login. Exposed data included patient lab values, plaintext passwords, and SpaceXSI internal documents, including a sales territory map and ad proposals. Claroc attributes the issue to an insecure default publishing setting, discoverable addresses, and flawed access controls. SpaceXSI says apps are private until shared and has removed its employees' 24 exposed apps. Claroc is notifying other affected owners directly.

Why it matters

Security firm Claroc reports that the overwhelming majority of web apps created with Grok, the AI assistant from SpaceXSI, were publicly reachable without any login. Claroc attributes the problem to a preselected sharing option, easily discoverable subdomain addresses, and weak access controls in the generated code. Exposed material ranged from games and calculators to sensitive content, including patient lab values, hospital staffing details, plaintext passwords, and internal SpaceXSI and X business documents such as a sales territory map and confidential ad proposals. Claroc's own testing also showed that a generated app could grant an outside account access to team records. SpaceXSI removed its employees' exposed apps but disputes the findings, saying apps stay private until shared. Claroc is notifying other affected owners directly and urges safer defaults, warning that insecure sharing features are a wider problem across AI providers.

Receipt № 28411 source · awaiting confirmation ◐

Evidence

1source· awaiting independent confirmation

No score is assigned. Sources and their independence are shown in the citation chain below.

Citation chain · 1 source

01med
the-decoder.comBloghttps://the-decoder.com/grok-built-apps-exposed-patient-data-plaintext-passwords-and-spacexsis-own-sales-pipeline/This source supplies Claroc's technical findings, its hands-on testing of Grok's publishing and access controls, SpaceXSI's response, and the wider pattern of similar sharing lapses at other AI providers.
PRIMARY
GrokModelClarocCompanySpaceXSICompany

Related

Nov 11Microsoft's Automatic Super Resolution is now officially out for the ROG Xbox Ally X - EngadgetNov 11US data brokers are selling half a billion dollars in RL training environments to Chinese AI labsNov 11New In-Memory Database Purpose-Built for AI Agents
Canonical: https://the-decoder.com/grok-built-apps-exposed-patient-data-plaintext-passwords-and-spacexsis-own-sales-pipeline/