Grok Leaks User Data via Encrypted Prompt Trick

Grok has a data leak problem, and xAI has known about it since June without fixing it. Researchers found that Elon Musk's chatbot can be tricked into handing over private user chats and personal details through a trick so simple it barely counts as hacking: encrypt the malicious instructions first. Once the harmful prompt is disguised in that way, Grok processes it without flagging the request as suspicious, then exfiltrates whatever data the attacker asked for.

The timing isn't great for the industry. Earlier this week, a separate group of researchers detailed an attack on Microsoft 365 Copilot for enterprise users that used a hidden input to pull a password straight out of someone's inbox. Two different assistants, two different companies, the same underlying failure. Both cases trace back to prompt injection, a vulnerability class that has dogged large language models since they started reading emails and webpages on people's behalf.

The problem isn't a bug that gets patched once and disappears. It's structural. LLMs are built to follow instructions wherever they find them, which means an attacker hiding commands in an email or an encrypted string gets the same obedience a legitimate user does.