XAI Grok chat leaks user data via prompt injection
A security research firm found a way to trick xAI's Grok chatbot into leaking a user's own chat data. The attacker hides encrypted instructions on a webpage, and just asking Grok to summarize that page can silently hand over the user's name, approximate location, subscription tier, and current conversation history.
- Report priority
- Medium
- Targets
- xAI Grok+1 more
How it works
- An attacker plants an encrypted block of text and a decryption key on a webpage.
- When a victim asks Grok to summarize that page, Grok uses its own built-in code tool to decrypt the hidden text and then follows the instructions inside it as if they were trustworthy.
What to do
Avoid asking Grok to summarize or browse links from sources you do not trust until xAI confirms a fix, since no patched version or timeline has been published.
Watch for an xAI security notice and limit sharing sensitive requests with Grok when it is summarizing outside links.
Technical details
Affected software: xAI Grok, grok.com
A victim asks Grok to summarize a webpage that looks ordinary but contains a hidden encrypted block. Grok's Python tool decrypts the block, and the recovered instructions tell Grok to gather the user's name, location, subscription tier, and current conversation and stuff them into what looks like a decryption key. Grok then visits a second attacker-controlled web address to fetch more context, sending that harvested information along in the page address, where the attacker's server logs it.
Adversa AI calls this technique Cryptographic Context Injection. Unlike older prompt-injection tricks using Base64 or simple ciphers, the payload is encrypted with PBKDF2 key derivation and AES-256-GCM, so Grok cannot decode it from model weights alone and must run it through its own Python sandbox. Once decrypted, Grok treats the recovered text as trusted tool output rather than untrusted webpage content, a trust-boundary failure that lets attacker instructions direct the agent to collect session data and exfiltrate it via a URL query string to an attacker-controlled site.
Across about 20 tests since June, the reported success rate was around 40 percent, with failures caused by decryption issues rather than injection defenses. No CVE, public patch, or in-the-wild exploitation has been confirmed.