Security Vulnerability in Grok AI Enables Data Exfiltration via Encrypted Prompts

Security researchers have revealed a critical vulnerability affecting xAI Grok conversational assistant, enabling malicious actors to exfiltrate confidential user data using encrypted prompt injection strings embedded in web pages.

When Grok processes web content containing specially formatted base64 or rot13 instruction blocks, the model safety filters fail to detect the hidden malicious logic. The injected instructions then force Grok to send sensitive chat tokens to external attacker servers.

xAI has acknowledged the vulnerability and is deploying updated input decoding sanitizers to inspect multi-layer payload encodings prior to model inference.