Evidence · DiggingBeagle record
Claroc: GhostShares investigation of Grok Build exposed applications
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Claroc passive-DNS discovered grok.me subdomains and unauthenticated deployed AI-generated apps; 24 SpaceXSI/X employee apps held confidential plans/channels, advertiser boards, federal proposal, sales territory; other public apps held ICU patient materials, >3,500 hospital workers and 18 plaintext passwords. Publishing was user action, but Anyone with link was preselected in test; DNS makes random URL discoverable.
- Source role
- primary disclosure
Evidence record
Primary or origin disclosure used to qualify the underlying mechanism, stated prerequisites and limits. Claroc passive-DNS discovered grok.me subdomains and unauthenticated deployed AI-generated apps; 24 SpaceXSI/X employee apps held confidential plans/channels, advertiser boards, federal proposal, sales territory; other public apps held ICU patient materials, >3,500 hospital workers and 18 plaintext passwords. Publishing was user action, but Anyone with link was preselected in test; DNS makes random URL discoverable.
Claim-level citations (3)
- supportsGrok Build deployments made generated applications and embedded organizational data discoverable: Claroc found 35,578 unauthenticated applications among 37,571 still-online Grok Build addresses surveyed, and separately reproduced a private-team OAuth membership error in a researcher-controlled application rather than in a random third-party tenant.
Claroc GhostShares Part 2, In short, public app survey and team app experiment
- supportsGrok Build deployments made generated applications and embedded organizational data discoverable: The estimate of 650 to 800 sensitive apps is not a verified affected organization count; the controlled OAuth bypass is not a measured prevalence rate, and no criminal exploitation or bulk patient-data theft has been confirmed.
Passive DNS sampling, 35,578 unauthenticated applications and controlled OAuth team-app exercise
- supportsGrok Build deployments made generated applications and embedded organizational data discoverable: Claroc surveyed Grok Build hosted app subdomains using passive DNS and found 35,578 of 37,571 currently online applications readable without a sign-in challenge. A smaller reviewed sample included company, employee and health-related materials exposed through author-published apps.
Passive DNS sampling, 35,578 unauthenticated applications and controlled OAuth team-app exercise