Grok will still hand over your private chats and personal data to an attacker, as long as the malicious instructions are encrypted first.
Security researchers found a way to trick xAI's Grok into exfiltrating user chat histories and other personal information, using a technique they're calling Cryptographic Context Injection. The method hides malicious instructions inside encrypted text embedded in content Grok is asked to process, letting the instructions slip past whatever filters are meant to catch obvious prompt injections. Researchers reported the flaw to xAI in June. As of this week, the attack still works and Grok is still leaking data.
This is the second prompt injection data theft bug disclosed in the same week - a similar attack hit Microsoft 365 Copilot for enterprise, using a secret input to pull a password out of a user's inbox. The pattern is identical across both cases and, really, every major AI assistant: none of them can reliably tell an instruction from you apart from one smuggled into a document written by someone else.
Every vendor's fix looks the same too - a guardrail that flags suspicious text and hopes it catches the next variant, instead of an actual structural defense that nobody has built yet.