安全公司发现 35000 多个 Grok 构建应用公开泄露数据
Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline
这事挺值得开发者留意的：35000 多个 Grok 做的应用因为默认设成"有链接就能看"，连患者数据和明文密码都裸奔在公网。用类似 vibe coding 工具发布应用前，先手动改权限，别信默认值。
安全公司 Claroc 发现超过 35000 个由 Grok 构建的应用处于完全公开状态，任何人都无需登录即可访问，其中包括患者数据和 SpaceXSI 的机密销售文档，部分应用甚至以明文存储密码。
问题根源在于默认设置：Grok 应用的访问权限默认预选了"任何拥有链接的人"，导致开发者在不知情的情况下把敏感数据发布到公网。事件曝光后，SpaceXSI 仅将自己内部的 24 个员工应用下线，其余泄露应用目前仍然可以访问。
这起事件说明低门槛应用生成工具的默认隐私配置可能带来系统性风险，企业用这类工具处理内部数据前，需要逐一检查分享权限设置。
Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline
Security firm Claroc found more than 35,000 Grok-built apps open to anyone without login, including patient data and confidential SpaceXSI documents. The cause: "Anyone with the link" was preselected as the default access setting. SpaceXSI took only its own 24 employee apps offline. The rest remain accessible. The article Grok-built apps exposed patient data, plaintext passwords, and SpaceXSI's own sales pipeline appeared first on The Decoder .
This report is categorized under AITOP's "Products" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Grok, xAI, AI安全, 应用生成.
Source attribution: curated from Decoder (@Jonathan Kemper).
