Watch on YouTube · subscribe for the daily brief

Grok can build a working web app from a chat message. Security firm Claroc found that almost all of those apps are open to anyone.

What Claroc found

• The count: of 37,571 Grok-built apps online, 35,578 opened without a sign-in, 94.7%. Most were games, landing pages and calculators; about 1 in 10 held internal business or personal data, and Claroc estimates 650 to 800 contained private data.
• The twist: 24 open apps were built by staff at X and SpaceXSI, the company that makes Grok. They held a confidential onboarding plan for a new sales hire, a sales territory map of 594 accounts, and an X ad proposal to a US federal agency marked confidential. "The company that makes Grok had its own internal material open to anyone holding the link," Claroc said, per Ars Technica.
• Other users: an intensive care briefing on a single patient, a list of more than 3,500 hospital employees, a fire department shift board, and a timesheet app whose code held 18 accounts with plaintext passwords. 30 other organizations were identified, 6 of them Fortune 500 companies; Claroc is withholding names.
• Why: the publish dialog had "Anyone with the link" preselected, and each app's subdomain on grok.me shows up in passive DNS databases that anyone with an account can search by pattern. In one test app Grok's own code added every signed-in user to the team before checking membership, so an outside Google account could read, edit and delete records.
• The fix exists: with "Only you", the test app blocked outside access. SpaceXSI took down its 24 staff apps within hours of questions from Ars; other users' apps stayed up.

For builders: if you shipped anything with an AI app builder, open its sharing setting before you read its code. Then test it from a browser that is not signed in.

Security

• Railway's stolen AI keys: keys customers stored on Railway were taken in an October breach and ran up an estimated $740,000 in unauthorized charges. The attacker's queries looked for AI provider keys. Railway first said it could not refund that spend; it now says it will pay when a provider will not. Refund terms differ: AWS and Google have started refunds, OpenAI and SpaceXSI review case by case.
• SGLang at NEAR AI: an attacker used a remote code execution flaw in SGLang to run code on a NEAR AI inference server inside a trusted execution environment, which "does not protect against a vulnerability in the software running inside the environment." The attacker reached 18 agents on an older deployment and account details for about 100 users. NEAR has not named a CVE or the affected SGLang versions.
• Fireworks AI, wider: the October breach also reached billing data and a subset of incomplete model weights and datasets, via a third-party cloud provider that hosted Fireworks R&D machines.

Research

• Agent distraction: Google measured what stale TODO comments do to coding agents. About 13% of sessions exposed agents to a TODO or FIXME reference, and in 6% of those the agent went off to work on it, usually unprompted. Detours cost 70% more steps, 77% more tokens and 105% more wait time; in 41% the bug was already closed. Google's TODO cleaner has removed thousands of obsolete references with over 95% reviewer acceptance.
• Signal, proven: Google DeepMind's AlphaProof Code verified Signal's cryptographic core, the code on users' devices, in four weeks instead of years. Agents wrote over six million lines of Lean proof and flagged about 1% of the code for human review; two planted bugs were caught immediately.

Money

• Anthropic's IPO terms: 825 million shares at $70 to $78, up to $64.4 billion (SiliconANGLE). At the top of the range the company would be worth $1.4 trillion fully diluted, per the Guardian, short of the $2 trillion that had been expected. Each of the seven co-founders is set to make about $250 million. Trading is expected next week.
• Mercor: $750 million at a $20 billion valuation to take expert-built evaluations from the labs to enterprises, with a custom benchmark per customer. Nvidia and Salesforce joined the round.

Products

• ChatGPT as a directory: OpenAI's new Business Hub lets companies verify profiles and launch a business agent that answers questions, with Google-style insights on views and clicks. Its checkout cart effort was retired in March.
• Ring on wheels and wings: Amazon's Ring Rover Cam costs $1,000 and ships December 16. The Ring Drone Cam flies 8 minutes per charge, struggles with mirrors and polished floors, and still needs FCC approval before a planned January 27 launch.
• New York's RAISE Act: the state opened its registration portal; the biggest AI labs get 72 hours to report a critical safety incident from January 1. Our full story is on the channel.

The through-line

Defaults decide. A share button preset to everyone, keys left where an attacker could read them, an old TODO an agent mistakes for a task. None of it was a clever attack.

One thing to do today: check the sharing setting of every app you built with an AI tool, and set it to private unless it must be public.

Sources covered

1 story · 97 sources (61 news, 31 company, 5 voices)

1. Build a daily dependency watcher with LangGraph and Amazon Bedrock AgentCore web search
   🏢AWS AI/ML↗🏢AWS AI/ML↗🏢Snowflake↗🏢Snowflake↗🏢Microsoft Research↗🎙️Simon Willison↗📰CNBC↗📰The Hackers News↗📰The Guardian↗📰The Register↗🏢Databricks↗🏢AWS AI/ML↗📰SiliconANGLE↗📰TechCrunch↗📰TechCrunch↗📰The Hackers News↗📰Ars Technica↗🏢LangChain↗📰BleepingComputer↗📰SiliconANGLE↗🏢Meta AI↗🏢AWS AI/ML↗🏢Meta AI↗📰SiliconANGLE↗📰Ars Technica↗📰TechCrunch↗🏢Google DeepMind↗🏢NVIDIA↗🏢Pinecone↗📰TechCrunch↗📰Ars Technica↗📰The Decoder↗📰The New Stack↗📰TechCrunch↗📰The Decoder↗📰Engadget↗📰Engadget↗📰TechCrunch↗📰InfoQ↗📰The Verge↗📰TechCrunch↗🎙️Ben Lorica↗📰TechCrunch↗📰The Decoder↗📰The Register↗📰The Decoder↗📰The Verge↗📰InfoQ↗🏢dbt Labs↗📰The Verge↗📰TechCrunch↗📰The Verge↗📰The Decoder↗📰TechCrunch↗🏢Google DeepMind↗🏢Neon↗🏢Google Cloud AI↗🏢OpenAI↗📰The Verge↗📰The New Stack↗📰The Verge↗📰The New Stack↗📰TechCrunch↗📰The New Stack↗📰LWN.net↗📰Ars Technica↗🏢OpenAI↗📰The Decoder↗📰The Verge↗📰SiliconANGLE↗📰SiliconANGLE↗📰SiliconANGLE↗📰SiliconANGLE↗📰The Verge↗📰The Verge↗🏢OpenAI↗📰The Hackers News↗📰The Decoder↗📰The Verge↗🎙️Simon Willison↗📰Ars Technica↗📰The Decoder↗🏢Supabase↗📰InfoQ↗🎙️Simon Willison↗📰InfoQ↗🎙️Simon Willison↗📰BleepingComputer↗🏢Starburst↗🏢AWS AI/ML↗🏢Temporal↗🏢Temporal↗🏢Polars↗🏢Elastic↗🏢Hugging Face↗🏢Hugging Face↗🏢DuckDB↗