Security firm Claroc has discovered that more than 35,000 apps built with Grok can be accessed without logging in, exposing a large amount of corporate secrets and personal private data. The affected organizations include SpaceX, X, and Tesla, and the exposed information even includes sensitive data on ICU patients and plaintext account passwords of enterprise employees. Investigations revealed that these app addresses can be obtained in bulk through passive DNS databases. By default, Grok sets the access permission of published apps to "anyone with the link," and the app code it generates contains a permission verification logic flaw—the system first adds the logged-in user to the team and then verifies membership, allowing unauthorized users to freely access and even modify data. Comparative testing shows that the default sharing permission of ChatGPT apps is owner-only, offering better security. After the incident was exposed, apps created by involved SpaceX and X employees have all been taken offline, but a large number of apps created by other users remain publicly accessible, and the platform has not yet made clear whether it will proactively notify other affected customers.