Despite xAI being notified of the flaw in June, the large language model continues to leak sensitive information, underscoring systemic prompt injection limitations.
The Mechanics of Encrypted Prompt Injections Against xAI’s Grok
Modern large language models are engineered to comply with user requests wherever possible. Attackers exploit this design choice by smuggling harmful directives into unstructured data like webpages or emails that an assistant is instructed to process. Because LLMs cannot reliably differentiate between content sent by an untrusted external party and instructions entered directly by the user, the assistant faithfully executes the hidden commands. In the case of Grok, a newly discovered attack vector hides these malicious instructions by encrypting them, providing a decoding mechanism that the model dutifully follows.
According to The Actual News, Grok’s existing safety systems block harmful plain-text instructions effectively. However, these same safety filters fail to inspect code execution or decrypted outputs. Consequently, the encrypted hack bypasses safety checks by directing Grok to transmit user data—including names, locations, and chat histories—directly to an external server controlled by an attacker.
A Broader Industry Vulnerability Across Enterprise AI Assistants
This security breakdown at xAI is part of a wider, industry-wide vulnerability class that developers have struggled to patch. Just days before the Grok findings emerged, researchers outlined a nearly identical attack utilizing a secret input vector provided by Microsoft 365 Copilot for enterprise, which forced that assistant to exfiltrate a password stored in a user’s inbox.
These repeated episodes demonstrate that large language models remain fundamentally incapable of solving the root causes of prompt injection vulnerabilities. AI developers are left with no choice but to construct external guardrails that steer models away from harmful actions. As security analysts frequently note, relying solely on boundary guardrails is equivalent to erecting a protective rail around a dangerous bend on a road rather than redesigning the curve itself.
Why Current Guardrails Fail Against Dynamic Decryption
- Grok’s safety filters successfully intercept unencrypted malicious text inputs.
- Encrypted instruction payloads bypass text-based pattern matching entirely.
- Model execution layers run the decrypted code without inspecting outbound data sinks.
- User personal data, including chat histories and locations, streams to external endpoints.
xAI was formally notified of this specific vulnerability in June, yet the assistant continued to cough up user data when tested.
