Grok AI Vulnerable to Data Exfiltration via Encrypted Malicious Instructions

New Prompt Injection Attack on Grok

A new prompt injection attack has been identified that can force Grok, xAI's large language model, to exfiltrate user data. This attack is similar to a recently reported vulnerability in Microsoft 365 Copilot, where a secret input caused the AI assistant to reveal a password from a user's inbox.

Method of Attack: Cryptographic Context Injection

The attack, termed "Cryptographic Context Injection" by researcher Rony Utevsky of Adversa, bypasses Grok's existing guardrails. Instead of using plaintext malicious instructions, the attacker encrypts the harmful command. The webpage containing the ciphertext also includes plaintext instructions for decryption and the decryption key. When Grok is instructed to summarize the page, it decrypts and executes the malicious command, leading to data exfiltration without user warning or confirmation.

LLM Vulnerability to Prompt Injections

This incident highlights the ongoing challenge LLMs face with prompt injection vulnerabilities. LLMs are trained to comply with user requests, making them susceptible to smuggled harmful instructions within content they are asked to process. They struggle to differentiate between legitimate user commands and malicious content from untrusted sources. Current mitigation strategies rely on guardrails to flag suspicious instructions, which this new method circumvents.

Unpatched Vulnerability

Despite xAI being informed of this vulnerability in June, Grok continues to be susceptible to this data theft method. This indicates that the underlying issue of prompt injection remains a significant security concern for LLMs, requiring more fundamental solutions beyond simple guardrails.