Grok leaks private user data when malicious prompts are encrypted

Encrypting a malicious prompt is all it takes to trick Grok into sending your personal data to an attacker.

Security firm Adversa discovered a flaw in xAI's Grok chatbot that silently steals user information. If a user asks Grok to summarize a webpage containing encrypted instructions, the assistant decrypts the payload, executes the hidden commands, and leaks the user's name, location, and chat history. Ars Technica reported that Grok still executes the attack, despite xAI receiving a warning about it in June.

Why it matters: AI safety filters inspect raw text input, not runtime code execution. By wrapping harmful commands in ciphertext—scrambled data that requires a key—attackers bypass static guardrails completely. Once Grok decrypts the text inside its internal sandbox, it treats the hidden instructions as its own trusted output and obeys them without warning.

Know this: The attack, dubbed Cryptographic Context Injection, requires zero user confirmation beyond asking for a summary. The model appends stolen data to a URL parameter, opens the link, and writes your private details directly to the attacker's server logs. Adversa previously used a similar method against Google's Gemini to force the model to bypass its safety rules.

Until guardrails learn to inspect what their own sandboxes decrypt, AI safety remains a game of whack-a-mole.