{"id":247130,"date":"2026-11-11T23:24:20","date_gmt":"2026-11-12T05:24:20","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/11\/over-35000-grok-built-apps-exposed-online-some-leaking-confidential-data-and-passwords"},"modified":"2026-11-11T23:24:20","modified_gmt":"2026-11-12T05:24:20","slug":"over-35000-grok-built-apps-exposed-online-some-leaking-confidential-data-and-passwords","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/11\/over-35000-grok-built-apps-exposed-online-some-leaking-confidential-data-and-passwords","title":{"rendered":"Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords"},"content":{"rendered":"\n<p>No app goes public until its creator clicks Publish. In the paid account the researchers used, the next step offered 3 access settings: \u201cAnyone with the link\u201d, \u201cInvited users\u201d and \u201cOnly you\u201d. \u201cAnyone with the link\u201d was already selected.<\/p>\n<p>The setting matters because an app\u2019s address does not stay secret, the researchers say. Opening an app makes the visitor\u2019s computer look up its subdomain in DNS. Passive DNS services record such lookups, and anyone with an account can search those records by pattern.<\/p>\n<p>Grok suggests 4 random words as each app\u2019s name, and about half of the names the researchers found followed that pattern. Such names are hard to guess, but that does not protect an app whose name already sits in a searchable list.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>No app goes public until its creator clicks Publish. In the paid account the researchers used, the next step offered 3 access settings: \u201cAnyone with the link\u201d, \u201cInvited users\u201d and \u201cOnly you\u201d. \u201cAnyone with the link\u201d was already selected. The setting matters because an app\u2019s address does not stay secret, the researchers say. Opening an [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1523],"tags":[],"class_list":["post-247130","post","type-post","status-publish","format-standard","hentry","category-computing"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/247130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=247130"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/247130\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=247130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=247130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=247130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}