# SZB-d12fff21cb: Claroc reports 35,000+ open Grok-built apps, some leaking data and passwords

Security firm Claroc says 35,578 of 37,571 Grok-built apps it found online were open without sign-in. Per the report, about 1 in 10 of the open apps contained internal business data, and 24 apps were built by staff at X and SpaceXSI.

- Type: Early warning
- Kind: Breach
- Vendor: SpaceXSI
- Product: Grok Build
- Status: Corroborated
- Sources: 3 distinct
- First seen: 2026-11-10 21:26 UTC

> No statement or filing from SpaceXSI has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Check whether any apps built with Grok are publicly reachable and require sign-in
- Rotate any passwords or API keys that may have been stored in Grok-built apps
- Restrict access to internal business data in any exposed app

## Timeline

- 2026-11-10 21:25 UTC: Made public by Mastodon
- 2026-11-10 21:26 UTC: First seen by cve.now
- 2026-11-11 13:48 UTC: Record last updated

## Evidence (3 sources)

- 2026-11-10 · Social · [Mastodon](https://m.ai6yr.org/@ai6yr/117594256437824268): “Grok Build, the vibe-coding agent from SpaceXSI, is leaking data—some of it proprietary business information and other sensitive secrets—from thousands of its users”
- 2026-11-11 · Press · [The Hacker News](https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html): “Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday.”
- 2026-11-11 · Social · [Mastodon](https://infosec.exchange/@thecybersecguru/117598108928268542): “35,578 AI-built applications exposed to the public internet.” (+1 more: [Mastodon](https://mastox.eu/@thecybersecguru/117598118450635506))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-d12fff21cb&body=https%3A%2F%2Fcve.now%2FSZB-d12fff21cb%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-d12fff21cb

### Was SpaceXSI breached?

Mastodon, The Hacker News and Mastodon report it. No statement from SpaceXSI has reached cve.now yet.

Source: https://m.ai6yr.org/@ai6yr/117594256437824268, https://thehackernews.com/2026/11/over-35000-grok-built-apps-exposed.html, https://infosec.exchange/@thecybersecguru/117598108928268542

### What should SpaceXSI users do?

Check whether any apps built with Grok are publicly reachable and require sign-in. Rotate any passwords or API keys that may have been stored in Grok-built apps. Restrict access to internal business data in any exposed app.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-d12fff21cb
Site guide for agents: https://cve.now/llms.txt