Case grok-chats-indexedModel & data leakWorldwide
Over 370,000 Grok conversations exposed in Google search via share links
Forbes found Grok's share button generated indexable URLs, so search engines surfaced hundreds of thousands of user chats, some with personal, medical or credential details.
MediumAttack on AIStatus: UnresolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 20, 2025
- Location
- Worldwide
- Target
- xAI Grok users
- Severity
- Medium
- Triggered by
- xAI product design flaw; exposure found by Forbes
- Actor type
- Accidental / misconfiguration
- Reported loss
- None reported
- CVE
- None
What happened
Forbes found Grok's share button generated indexable URLs, so search engines surfaced hundreds of thousands of user chats, some with personal, medical or credential details.
Impact: More than 370,000 user conversations publicly searchable, some containing names, passwords, medical details and instructions for drugs, explosives and malware
Who triggered it
Actor: xAI product design flaw; exposure found by Forbes
Attribution: Self-evident from Forbes investigation; xAI did not dispute the indexing
Motive: None (accidental exposure via share feature)
How it happened
Attack vector: Grok 'Share' button created public URLs on grok.com with no noindex protection or user warning, which Google, Bing and DuckDuckGo crawled and indexed
Root cause: Share links published on the open web without noindex headers or consent disclosure, repeating the earlier ChatGPT shared-link indexing problem
Timeline
- Forbes reports over 370,000 Grok conversations indexed by Google
- Fortune and others detail exposed content including passwords, medical questions and harmful instructions
Response
No formal statement from xAI beyond a Google spokesperson noting publishers control indexing; no public confirmation of a feature fix
Current status: Unresolved
Sources (open in a new tab)
- Fortune fortune.com
- Forbes Australia forbes.com.au
- Yahoo News yahoo.com
Cite this case
Over 370,000 Grok conversations exposed in Google search via share links. AI Threat Watch, case grok-chats-indexed, Aug 20, 2025. https://aithreat.io/cases/grok-chats-indexed/
Permanent link: https://aithreat.io/cases/grok-chats-indexed/