Grok tricked into leaking user data via encrypted prompt injection

Security researchers have found a new way to steal data from Grok, the AI assistant owned by Elon Musk's xAI. The attack uses encrypted instructions to bypass the model's existing safeguards, allowing it to hand over user chats and personal information without warning.

The method was discovered by Rony Utevsky, a researcher at the security firm Adversa. Instead of writing malicious commands in plain text, the attacker encrypts them. The webpage hosting the encrypted content also includes plaintext steps for decrypting it, along with the decryption key. When a user asks Grok to summarize that page, the assistant follows the hidden command - no confirmation or warning is triggered.

At the time of reporting, Grok was still vulnerable to this attack, even though xAI was informed about it in June. This incident follows a similar attack earlier this week targeting Microsoft 365 Copilot, where a secret input forced the assistant to reveal a password from a user's inbox.

Experts say these examples highlight a fundamental weakness in large language models: they cannot fully fix prompt injection vulnerabilities, a major class of security flaws. The current workaround is to add guardrails that steer the model away from harmful actions, rather than solving the root cause. As one analogy puts it, it's like placing a protective rail at a dangerous curve instead of banking the road itself.

Source: Ars Technica