Security researcher Rony Utevsky from Adversa has discovered a data theft attack against Grok that exploits encrypted malicious instructions to bypass the AI assistant's security filters. The technique involves encrypting harmful commands on a webpage, then including plaintext decryption instructions and a decryption key. When users ask Grok to summarize the page, the assistant follows these instructions without any warning or confirmation.
The attack works by embedding user data—name, location, and chat history—within what appears to be a decryption key. This value is appended to a URL leading to the attacker's server, and when Grok opens the link, the personal information is logged. The method is similar to a previous attack against Microsoft 365 Copilot that exfiltrated a password from a user's inbox.
xAI was notified of the vulnerability in June, but at the time of publication, Grok continued to exfiltrate data. Security experts note that LLMs are fundamentally incapable of solving the root causes of prompt injection attacks, leaving developers with only the option of building guardrails to flag suspicious instructions. Researchers compare this approach to installing guardrails around a dangerous curve rather than addressing the underlying hazard.