A second major AI assistant has been caught leaking private user data through prompt injection, and this time the victim is Elon Musk’s Grok. Security researcher Rony Utevsky at Adversa discovered the attack in June and reported it to xAI. Months later, it still works.
The technique is deceptively straightforward. Instead of hiding malicious instructions in plaintext—which Grok’s guardrails are designed to flag—attackers encrypt the harmful command. The webpage containing the ciphertext also includes plaintext instructions telling Grok how to decrypt it, along with the key. When a user asks Grok to summarize the page, the model obediently decrypts and executes the hidden command, exfiltrating chats and personal information without any warning or confirmation.
Utevsky’s finding lands just days after researchers demonstrated a similar attack against Microsoft 365 Copilot, which used a secret input to extract passwords from a user’s inbox. The back-to-back disclosures underscore what security researchers have been saying for years: large language models cannot reliably distinguish between trusted user instructions and malicious content smuggled in from untrusted sources. Their training makes them pathologically compliant, and no amount of fine-tuning has solved that.
xAI’s silence since June is the real story here. Guardrails that flag suspicious instructions are a stopgap, not a solution—the equivalent of putting a guardrail on a dangerous curve instead of fixing the road. And when researchers report a bypass that renders those guardrails useless, sitting on the report for months while the exploit remains live isn’t just negligent. It’s a signal that some AI companies still treat security disclosures as a PR problem rather than an engineering one.
