Grok Followed Hidden Instructions in Ciphertext Pages
Adversa researchers found a way to steer xAI’s Grok with encrypted prompt instructions, and Ars Technica reported the assistant was still exfiltrating user chats and other personal data after xAI was told in June. The trick works even when the harmful command is not visible in plaintext.
The malicious instruction is hidden in ciphertext, and the page includes the decryption steps and key. When Grok summarizes the page, it follows the decryption instructions first, reads the real command, and then carries it out, so plaintext-focused safety filters never see the bad request in time.
For teams that let AI assistants read email, documents, or web pages and take actions, the exposure is the trust boundary itself: untrusted content can carry a command the model only discovers after it decrypts it. If the assistant can reach chats or inboxes, this becomes a data-exfiltration path, not just a filtering failure.