Abstract:
Grok never disappoints when it comes to breaking your skin. Just now, security company Claroc discovered that
more than 35,000 applications built with Grok can be accessed without logging in, and some of them directly exposed corporate secrets and personal privacy.
The most eye-catching thing is that Lao Ma’s own SpaceXSI (the company after the merger of SpaceX and xAI) and X are also among them.Employee onboarding plans, sales customer information, advertising proposals... even their own bottom line was exposed.
Moreover, Tesla, which did not merge, did not escape. A service center rating form puts the names, work efficiency and bonus status of 22 technicians on a public web page.
What’s even more outrageous is that not only are our own employees who use our own products suffering, but the leaked content also involves ordinary people’s sensitive information.
Including, ICU patients’ test results, imaging examinations, ventilator usage records, and clear text account passwords of corporate employees.
Here I am, just use Grok and get one-click box opening for free?
What exactly was revealed?
Specifically, at the beginning of the matter, Claroc tested 43,551 (37,571 were still online) Grok Build application addresses and found that 94.7% of online applications could be opened without logging in.
Although most of these applications are AI swill made by you and me, like small games, calculators, etc...
After model screening and manual sampling, Claroc estimates that there are about 650-800 applications containing private data.
The institutions involved include SpaceXSI, X, and 30 other companies, 6 of which were selected into the Fortune 500.
How sensitive this data is, you will know with a few examples:
1. An ICU patient briefing sheet, including patient test results, imaging examinations and ventilator usage status.
2. A contractor’s time management application has written the clear text passwords of 18 accounts into the script, and anyone who visits the page can download it.
3. SpaceXSI’s internal sales tool, including strategic customer accounts, sales opportunities and internal team information.
4. Tesla service center rating form, including employee names, work efficiency and bonuses.
. . . .
Looking at it, it turns out that there is something from "someone good" on Vibe Coding, recording his password and physical examination report.
But it was too outrageous for Grok to directly expose it to the public.
So, how come these data, which should only be circulated within the company, appear on public web pages?
How could a random link become the entrance to a box opening?
To put it simply, when you use Grok vibecoding, it will assign an independent URL to each published application, similar to the random name .grok.me.
These random names are made up of several words and are designed to be difficult for others to guess. But the problem is that
the URL is difficult to guess, which does not mean that the access rights are secure.
Claroc found that these application addresses can be found in batches through the Passive DNS (Passive DNS) database.
To put it simply, every time someone visits a website, the computer needs to query the server address corresponding to the domain name through DNS. Some DNS resolution services collect these query records and put them into a searchable database.
Thus, a discovery path is formed:
Someone accesses the application → DNS query leaves a record → The domain name enters the passive DNS database → External personnel find the application address in batches.
If the app's access permissions are set to "Anyone with the link," then as long as the URL is found, it can be opened directly.
In other words, Grok uses random URLs to increase the difficulty of application discovery, but does not really solve the access control problem.
For the sake of fairness, Claroc also conducted a control test with the ChatGPT application: its application address may also be included in passive DNS, but the sharing panel is set to "Only Me" by default. Even if others find the URL, they cannot access it.
This is a win for ChatGPT!
Also, to verify whether the code generated by Grok is reliable and how team permissions are handled.
Claroc later used fictitious data to build a customer management application for a four-person sales team.
Although Grok did automatically add Google and X login functions, researchers found a low-level error after checking the code:
The application first adds the logged-in person to the team, and then checks whether he is a team member. That is to say, I will first drag you into the group, and then see if you are a group member.
They must all be group friends...
The researcher then logged in using a Google account that had never been invited. Not only did he see all the customer information, he also successfully modified one record and deleted another.
In other words, as long as you want, Grokd's door is always open for you.
Official response and follow-up
After the incident was exposed, SpaceXSI told the media that applications are private until the creator actively shares them, and release requires multiple steps.
The company also said that its employee accounts are set to "only you" by default, and that to make the application public, you need to actively modify the permissions.
But Claroc said that in the paid account it used for testing, the publishing panel pre-selected "anyone with the link."
The key here is:
Private before publishing, and who has access by default when publishing are two questions.
If you click "Publish" all the way, the final pre-selected access scope will still be all people who hold the link. Even if you confirm several times, a list of team members will not be automatically added.
The researchers also verified Grok’s existing permission control capabilities.
After switching to "Only You", strangers will be denied access to the page and data interface; canceling publishing can also take the application offline within a few seconds.
So, Grok has protective measures that can be used. The question is whether these measures are actually used when users release internal tools.
At present, this matter has caused a quarrel on Twitter. Some people think that the permissions are set by people themselves, while others think that there is a problem with Grok's permission settings.
As for the subsequent processing, it was not until a few hours after Ars Technica sent the interview email that SpaceXSI began to remove the relevant links.
As of the release of the report, 24 applications created by SpaceXSI and X employees have all been offline.
However, a large number of applications created by other users are still accessible, and Claroc has begun contacting affected institutions on its own.
As for whether the platform will proactively notify other affected customers, Ars Technica has not yet received a clear answer.
Comments