GhostShares research finds 35,578 Grok apps exposed to public via default link settings

Details

GhostShares (Claroc) identified 35,578 Grok apps (94.7% of 37,571 online) accessible without login due to default 'Anyone with the link' settings. The apps were discovered via passive DNS subdomain enumeration.
24 apps created by SpaceXSI and X staff were exposed, containing confidential onboarding plans, sales territory maps for 594 accounts, and federal advertising proposals.
Data from 30 external organizations was leaked, including 26 with over 1,000 employees and 6 Fortune 500 companies, spanning sectors like construction, energy, and healthcare.
Grok's default security configuration allows unauthenticated access to apps with databases, and its sign-in flow adds users to teams without verifying membership, enabling data modification by non-owners (tested on Claroc's own apps).
SpaceXSI removed the 24 staff apps but did not address other users' exposed apps, maintaining that the default access setting is a design choice rather than a bug.
Claroc recommends serving shared apps via unguessable paths, adding organization-specific email restrictions, and changing the default access setting to 'Only you'.

Key point