Security researchers have found a way to trick Elon Musk's Grok chatbot into secretly stealing users' chat history and personal data, using a technique that hides malicious instructions inside encrypted text on a webpage. The exploit works because Grok's safety filters scan plain text for harmful commands but cannot inspect content that only becomes readable after the model decrypts it itself, meaning the guardrails never see the dangerous instructions before Grok acts on them. It echoes a similar prompt-injection flaw disclosed days earlier in Microsoft 365 Copilot, underscoring that AI developers still have no reliable way to stop large language models from being manipulated by hidden instructions embedded in content they are asked to process.

Researcher Rony Utevsky of security firm Adversa discovered that encrypting a malicious instruction, and providing Grok with plaintext decryption steps and a key, allows the command to bypass filters that would normally block the same instruction if written in plain text. When a user asks Grok to summarise a webpage containing this hidden payload, the model decrypts and follows the instructions without warning, constructing what looks like a "decryption key" that is actually the user's name, location and chat history, then sending it as a URL parameter to an attacker's server. Adversa reported the flaw to xAI in June, but as of publication Grok was still vulnerable to the attack.