Twitxy
Saved
@3pun0x's profile picture
View on X

Asaf Aprozper

Verified account This account is verified. Learn more

@3pun0x

Cloud Incident Responder | Speaker at fwd:cloudsec, CodeBlue Japan, BsidesCyprus. Tweets are my own.
Israel Joined December 2016
750 Following 587 Followers 516 Posts

Latest posts 5

Pinned post

Asaf Aprozper Verified account @3pun0x
@elonmusk your team pulled its 24 open Grok apps after our securtity report. 35k+ more are still open, some from Fortune 500s. Claroc shows companies every app their people build with AI, hardens it and verifies it stays locked. We're raising and want you in!
blog.claroc.io/ghostshares-gr…
blog.claroc.io GhostShares 2: Grok Apps Exposed xAI’s Business Secrets and People’s Private Data 35,578 Grok-built apps opened for anyone on the public internet, including SpaceXSI's sales data and medical records.
Asaf Aprozper Verified account @3pun0x
35,578 Grok-built apps opened for anyone with the link. Most of their owners never chose that: Publish arrived with "Anyone with the link" already selected. Our full research: blog.claroc.io/ghostshares-gr…
blog.claroc.io GhostShares 2: Grok Apps Exposed xAI’s Business Secrets and People’s Private Data 35,578 Grok-built apps opened for anyone on the public internet, including SpaceXSI's sales data and medical records.
The Hacker News @TheHackersNews 21h
🚨 35,578 Grok-built apps were accessible online without signing in.

Some exposed confidential X documents, employee passwords, and patient data.

Even hard-to-guess app URLs could be found through searchable DNS records.

Full findings - thehackernews.com/2026/11/over-3…
View quoted post on X
Asaf Aprozper Verified account @3pun0x
Author here, thanks for sharing it. The difference in one line: a shared ChatGPT, Claude or Gemini chat keeps its secret in the URL path, which DNS never sees. A Grok app gets its own hostname, every visit sends that name through DNS, and passive DNS data lists it.
International Cyber Digest Verified account @IntCyberDigest 23h
This is a massacre.

This is how they found all the publicly exposed Grok Build apps (and you can too).

And why the public links from ChatGPT, Claude and Gemini aren't directly exposed like the ones from Grok.

Hope they fix this ASAP.

Full research:
blog.claroc.io/ghostshares-gr…
View quoted post on X
Asaf Aprozper Verified account @3pun0x
@elonmusk your team pulled its 24 open Grok apps after our report. 35,554 more are still open, some from Fortune 500s. Claroc shows companies every app their people build with AI, hardens it and verifies it stays locked. We're raising and want you in!

arstechnica.com/security/2026/…
arstechnica.com Grok Build coding agent leaks oodles of confidential info, some belonging to SpaceXSI Researcher finds 35,000 Grok Build apps wide open to anyone who looked for them.