Grok Build: AI apps expose trade secrets and personal data | heise online

More than 35,000 web applications created with the vibe-coding tool Grok Build were accessible to third parties without logging in. Claroc, a company specializing in AI security, discovered that the apps’ sharing links could be found through public DNS databases. Based on a sample, Claroc estimates that 650 to 800 of the applications contained private data. The Grok provider SpaceXSI itself was also affected.

In 24 publicly accessible apps belonging to SpaceXSI and X employees, the researchers found, among other things, a confidential onboarding plan containing internal system addresses, as well as a sales map with information on 594 strategically important customer accounts and their sales activities. At 30 other organizations, including six Fortune 500 companies, they discovered employee lists and medical data belonging to an intensive-care patient. A time-tracking app contained the passwords for 18 user accounts in its publicly accessible source code.

Sharing links discoverable via DNS

One cause of the leak lies in the structure of the sharing links, according to Claroc. Published Grok apps are assigned their own web address, “randomname.grok.me,” by default. The random name is intended to make them difficult to guess. However, when accessed, the name is queried via the Domain Name System (DNS), which maps web addresses to the corresponding servers. Passive DNS services record such queries and store the domain names in searchable databases. This allows outsiders to find supposedly secret links.In shared ChatGPT conversations, Claude Artifacts, and Gemini content, the random identifiers are located in part of the web address that is not transmitted during DNS queries.

Read also

Databricks: Detect and avoid security vulnerabilities when vibe coding

heise developer

Private chats with Grok publicly discoverable via Google

AI code increasingly leads to production outages

The problem is further compounded by Grok Build’s sharing settings: According to Claroc, when publishing, it is the default for anyone with the link to access the app. To restrict access to invited people or the creator, users must first change this setting.

SpaceXSI removes its own apps

Claroc also discovered security vulnerabilities in code generated by Grok. In one of its own test apps, outsiders were able to add new records without logging in. A second app offered sign-in via Google and X, but also automatically added uninvited users to the team. This allowed them to read, modify, and delete fictitious customer data.