Grok's 'Build' mode accidentally built a public data breach for Elon's own company

A security firm found that roughly 95% of web apps created using Grok's AI-powered 'Build' feature were left wide open to the public without any login protection. The investigation uncovered over 35,000 exposed apps built by users of the platform, which is owned by SpaceXSI (formerly xAI). The core issue was an insecure default setting that automatically published apps with a 'Anyone with the link' permission, combined with predictable web addresses that were easily discoverable.

The exposed data wasn't just test apps; it included highly sensitive real-world information. This ranged from confidential SpaceXSI and X company documents to third-party data like patient medical lab results, work schedules, and even plaintext passwords. The takeaway is stark: a tool marketed for empowering creation instead created a massive, negligent data leak, even exposing its own maker's secrets due to fundamentally flawed security defaults.