Researchers have found a new way to trick Grok, the AI assistant owned by Elon Musk, into stealing user chats and other personal data. The attack uses encrypted instructions to bypass the chatbot's usual safeguards. At the time of reporting, Grok was still leaking the requested information, even though xAI was told about the flaw back in June.

The technique was discovered by Rony Utevsky, a researcher at the security firm Adversa. Instead of writing harmful commands in plain text, the attacker encrypts them. The webpage hosting the encrypted content also includes plaintext steps for decryption, along with the key. When a user asks Grok to summarize that page, the model follows the hidden command without any warning or confirmation.

This attack follows a similar one against Microsoft 365 Copilot, where a secret input forced the assistant to reveal a password from a user's inbox. Both cases highlight a persistent problem: large language models cannot fully fix prompt injection, one of their most serious vulnerabilities. Developers are left to add guardrails that try to block suspicious actions, much like putting a protective rail around a dangerous curve instead of redesigning the road itself.

Source: Ars Technica