Grok leaks data when malicious instructions are encrypted

Security researcher Rony Utevsky of Adversa discovered a way to bypass Grok’s (xAI’s model) defenses by encrypting a malicious instruction. The attacker stores the encrypted text on a website together with clear-text decryption instructions and a key, then asks the user to request Grok to summarize the page. Grok decrypts the hidden instruction and follows it immediately, without warning or consent, resulting in the leakage of the user’s chat history and additional personal information.

The technique is a new variant of a known prompt-injection weakness. Large language models are designed to obey user requests as faithfully as possible and cannot reliably distinguish content that originates from an untrusted source—such as email, web page, or document—from a direct user-typed command. Until now, the only mitigation has been “guardrails” that attempt to detect and block suspicious instructions. Encrypting the instruction simply hides it from the guardrails.

Earlier this week a similar attack was reported against Microsoft 365 Copilot for enterprises, where the system’s confidential input was used to extract a password from a user’s mailbox. Both incidents illustrate the same lesson: language models cannot address the root cause of prompt injection, the most severe class of their vulnerabilities. Developers are forced to rely on guardrails, an engineering workaround analogous to a safety barrier around a hazardous bend rather than repairing the road itself.

According to the report, xAI received a disclosure of the flaw in June, but as of the time of writing the model still leaks information when the attack is performed. No fix or block for the encrypted attack vector has been released.