Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

The Hacker News

November 11, 2026 at 12:19 PM

Overview

A recent security review by Claroc revealed that over 35,000 apps built using the Grok platform were publicly accessible without any sign-in requirements. Out of 37,571 apps examined, 35,578 were found to be open, including 24 developed by employees of X, the social media network, and SpaceXSI, the company behind the Grok AI assistant. While many of these apps were benign, such as games and calculators, approximately 10% contained sensitive internal business data, raising serious concerns about data exposure. This incident highlights a significant risk for companies that may unintentionally expose confidential information through poorly secured applications. Organizations using Grok-built apps need to take immediate action to secure their applications and protect user data.

Key Takeaways

Affected Systems: Grok-built applications, including those by X and SpaceXSI
Action Required: Organizations should review their Grok-built applications, implement authentication requirements, and secure any sensitive information that may be exposed.
Timeline: Newly disclosed

Original Article Summary

Of the 37,571 Grok-built apps that security company Claroc found online, 35,578 were open to anyone without a sign-in, the researchers said yesterday. They included 24 apps built by staff at the social network X and at SpaceXSI, the company that makes the Grok AI assistant. Most of the open apps were games, landing pages, and calculators, but about 1 in 10 contained internal business or

Impact

Grok-built applications, including those by X and SpaceXSI

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Newly disclosed

Remediation

Organizations should review their Grok-built applications, implement authentication requirements, and secure any sensitive information that may be exposed.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

eBPF Rootkits: Why Underground Actors Are Taking Notice

BleepingComputer

Researchers have found that Linux eBPF rootkits are gaining traction among cybercriminals, who are utilizing these advanced techniques to conceal malicious activities on systems without needing to load traditional kernel modules. This method allows attackers to evade detection by conventional security measures. The information is being actively shared in underground forums, where hackers are posting source code, tutorials, and exploits specifically targeting Linux environments. This development is concerning for organizations that rely on Linux systems, as the ability to hide harmful actions makes it significantly harder for security teams to identify and respond to intrusions. As these rootkits become more prevalent, companies using Linux must enhance their security protocols to defend against these stealthy threats.

Nov 11, 2026

N-able releases security hotfixes for zero-day vulnerabilities

BleepingComputer

N-able has released hotfixes to address serious zero-day vulnerabilities in its N-central remote monitoring and management (RMM) platform. These vulnerabilities were publicly disclosed over the weekend, prompting the company to take affected hosted environments offline to mitigate potential risks. Users of the N-central platform should apply these hotfixes promptly to secure their systems against possible exploitation. The situation emphasizes the importance of timely updates in the face of emerging security threats, as attackers often seek to exploit newly discovered vulnerabilities. This incident serves as a reminder for organizations using this platform to remain vigilant and proactive in their cybersecurity practices.

Nov 11, 2026

We Built An Agent That Broke All of Our Security Rules. Here's What We Learned.

The Hacker News

Token, a company focused on AI agents, built a new agent that inadvertently violated its own security rules regarding identity, access control, and traceability. This agent operated using a user's authenticated browser session, exposing potential risks associated with AI integration. The team at Token realized that these oversights could lead to significant security vulnerabilities, prompting them to rethink their defensive strategies for AI agents. This incident serves as a cautionary tale for companies developing similar technology, emphasizing the need for strict adherence to security protocols to prevent unauthorized access and data breaches. As AI continues to evolve, ensuring robust security measures is crucial for safeguarding user information.

Nov 11, 2026

eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise

The Hacker News

eMudhra has revoked eight of its intermediate certificate authorities (CAs) following a key compromise incident in October. Initially, the company believed these CAs were unaffected, but a flaw in an internal Python script led to their revocation. Each CA has its own private key, which is used to sign the certificates eMudhra issues. Although the keys themselves were not compromised, the issue with the script raised concerns about the integrity of the certificates. This situation affects users relying on eMudhra's certificates for secure communications, highlighting ongoing challenges in certificate management and security practices.

Nov 11, 2026

Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches

The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged two vulnerabilities in Cisco BroadWorks and Openwave Messaging Webtop Media Transcoder, noting that they are currently being exploited in the wild. The first vulnerability, identified as CVE-2026-20320, has a CVSS score of 7.5 and involves improper restrictions on XML external entities. This means attackers could potentially manipulate XML data to gain unauthorized access or execute malicious commands. Organizations using these products should take immediate action to secure their systems, as the vulnerabilities can lead to significant data breaches or system compromises. Patches are available, but the urgency is heightened due to ongoing exploitation.

Nov 11, 2026

Artex: The AI Pen-Test Tool Hackers Turned Into a Weapon

darkreading

The open-source Artex framework, along with 45 other penetration testing tools, has been repurposed by hackers to conduct credential attacks and cloud breaches at unprecedented speeds. This misuse allows attackers to target various industries, raising significant concerns about security among companies that utilize these tools. Researchers have highlighted that the forks of Artex are not just theoretical threats; they are actively being exploited, making it crucial for organizations to be vigilant. As these tools can execute attacks swiftly across different platforms, the risk of widespread breaches increases. Companies using Artex or similar tools should review their security measures to mitigate potential risks.

Nov 10, 2026