Researchers bypass Grok's safeguards using encrypted malicious instructions

Grok, the AI assistant owned by Elon Musk's xAI, can be forced to steal user data through a remarkably straightforward technique. Security researchers have demonstrated how to evade the platform's safety guardrails by encrypting malicious instructions and embedding decryption instructions directly alongside them.

A new attack pattern#

Researcher Rony Utevsky at Adversa, a security firm, uncovered this vulnerability by exploiting a fundamental weakness in how large language models process information. Rather than embedding harmful commands in plain language—which Grok's guardrails are designed to catch—attackers can encode them in ciphertext. A webpage can then contain plaintext instructions for decryption along with the necessary key. When a user asks Grok to summarize the page, the system decrypts the hidden instruction and executes it automatically, with no warning or user confirmation required.

The broader prompt injection problem#

This attack is the latest in a series of vulnerabilities affecting major AI systems. Earlier in the same week, researchers demonstrated how Microsoft 365 Copilot could be tricked into stealing passwords from a user's email through similar injection techniques. Both incidents underscore a critical limitation: as noted in prior reporting, LLMs fundamentally struggle to distinguish between content created by untrusted third parties—such as email senders or website authors—and direct user instructions.

The core issue stems from the models' training to be helpful and compliant with requests. Attackers exploit this by smuggling harmful directives into materials the assistant is asked to process, and the system dutifully executes them.

Why guardrails aren't enough#

Security experts increasingly recognize that prompt injection represents a root architectural problem with current LLM design. Guardrails—filters designed to flag and block suspicious instructions—function much like protective barriers on a dangerous road curve rather than addressing the underlying structural flaw. This defensive approach has repeatedly proven inadequate, as creative attackers devise new ways to circumvent safety layers.

At the time of publication, xAI had been aware of the Grok vulnerability since June but the assistant was still leaking user data, suggesting the company had not yet deployed a comprehensive fix.