AI Apps Leak Sensitive Data: Passwords & More Exposed

Grok Build, an AI platform from SpaceXSI, has been found to have significant security vulnerabilities that led to the exposure of confidential data. Researchers discovered that thousands of applications published through the platform were widely accessible due to insecure default sharing settings. These apps, which are generated via a chat-like interface without manual coding, were inadvertently publishing sensitive business information, healthcare records, passwords, and internal documents.

The security researchers identified that the default privacy setting for publishing apps was "Anyone with the link," a setting many users apparently did not change. This meant that even without a shared link, the applications were discoverable through passive DNS services. Further investigation revealed that a large majority of these apps did not require any password for access, leading to the leakage of critical information.

Examples of leaked data included a hospital employee directory, patient information in an intensive care briefing, and a trucking company's recruitment database. Even SpaceXSI's own internal information, such as onboarding plans and sales strategy documents, was found exposed. The researchers also demonstrated that some data within these apps could be modified by unauthenticated visitors. Following the disclosure on November 8th, SpaceXSI promptly took action, making all its apps unavailable within two days and beginning the process of notifying affected users.