[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg31bR__KP3dFg-TP99JrqBuHPeRjetvE4XvBWMBQt3w":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"98cd3fb5-3092-4448-bbb4-8d08f35aad26","Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords","grok-ai-app-builder-exposes-over-35-000-apps-leaking-confidential-business-data-8bf44d","Researchers found that apps built with Grok’s app builder are open to Anyone online. Thousands of these apps hold private business data, staff details, plain-text passwords, and patient information. No hacking was needed to reach them. Grok’s Build mode creates and publishes chat-generated apps under grok.me, while its parent company, SpaceXSI (formerly xAI), did not […] The post Grok AI App Builder Exposes Over 35,000 Apps, Leaking Confidential Business Data and Passwords appeared first on Cyber Security News.","Researchers discovered that 94.7% of 37,571 Grok-built apps accessible via grok.me were publicly exposed without authentication, leaking sensitive data including patient medical records, employee rosters, plain-text passwords, and internal corporate information. SpaceXSI (Grok's parent) removed its own 24 exposed apps after disclosure but did not address third-party exposures. The vulnerability stemmed from overly permissive default access settings and passive DNS records enabling enumeration of app addresses.","Grok AI app builder exposes 35,578 public apps with confidential business data, passwords, and patient information.","https:\u002F\u002Fcybersecuritynews.com\u002Fgrok-ai-app-builder-exposes-data\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGrok-AI-App-Builder-Exposes-Over-35000-Apps-Leaking-Confidential-Business-Data-Passwords-and-Medical-Records.webp","2026-11-11T12:17:14+00:00","2026-11-11T13:00:24.780829+00:00",9,[17,20,23,26],{"name":18,"type":19},"Grok AI App Builder","product",{"name":21,"type":22},"SpaceXSI","vendor",{"name":24,"type":25},"Passive DNS","technology",{"name":27,"type":19},"Meta Muse","c70f3a41-2f0c-4608-870d-b8cbcd8be076",{"id":28,"icon":30,"name":31,"slug":32},null,"Cloud Security","cloud-security",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[50],{"type":51,"value":52,"context":53},"domain","grok.me","Platform hosting publicly exposed Grok-built apps",[21,18,27],{"controls":56,"vendors":141},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"slug":87,"name":88,"problem":89,"products":90},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":116,"name":117,"problem":118,"products":119},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":137,"product_name":138,"url":139,"description":140},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"grok-ai-platform-exposes-35000-apps-via-insecure-default-access-settings","Grok AI Platform Exposes 35,000+ Apps via Insecure Default Access Settings","The root cause of this breach was overly permissive default access configurations in the Grok AI app-building platform, which made apps publicly accessible without authentication unless users explicitly restricted them. Because most developers assume platforms default to private or secure settings, tens of thousands of apps leaked sensitive data including medical records, plain-text passwords, and internal corporate data. The discoverability was compounded by passive DNS enumeration, allowing researchers — and potentially attackers — to systematically identify exposed app endpoints. This incident illustrates that platform providers bear responsibility for secure defaults, as most users will never harden settings they are unaware of. Failing to address third-party exposures after disclosure also reflects a gap in responsible platform-level incident response.",[147,148,149,150,151],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 AC-3: Access Enforcement","OWASP A05:2021 Security Misconfiguration","GDPR Article 25","NIS2 Article 21(2)(i)",{"GDPR Article 25":153,"NIS2 Article 21(2)(i)":154,"NIST SP 800-53 AC-3: Access Enforcement":155,"OWASP A05:2021 Security Misconfiguration":156,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":157},"GDPR Article 25 (Data Protection by Design and by Default) requires that systems default to the most privacy-protective settings, which would have required apps to be private by default rather than publicly accessible.","This point covers access control policies, requiring that entities implement measures ensuring only authorised parties can access systems and data, directly addressing the absent authentication on exposed apps.","AC-3 requires systems to enforce approved authorizations for access to resources, meaning unauthenticated public access to sensitive app data should have been blocked by default.","Overly permissive default access settings that expose thousands of apps without authentication is a textbook case of security misconfiguration at the platform level.","This control requires that software platforms ship with secure default configurations, which would have mandated private-by-default access for newly created apps rather than public exposure."]