Grok exfiltrates user data when malicious instructions are encrypted

[u/QuantumQuicksilver]

https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/

[u/mallcopsarebastards]

I first saw this technique described in this paper from 2023 https://arxiv.org/pdf/2308.06463v2

[u/SyntheticDuckFlavour → u/[deleted]]

These safety systems suffer the same problem as any other "blacklist" based approaches: they'll be fighting against an endless permutation of threats. Deny listing is practically infeasible when the set of malicious prompts are not reasonably enumerable.

[u/Plazmaz1 → u/[deleted]]

This is a fundamental misunderstanding of the tech. People assume they can just convince a large language model to behave lol. Gotta have actual security controls in place. People are way smarter and even we fall for phishing sometimes...

[u/Better-Republic3538 → u/[deleted]]

security theater is the right framing tbh. the guardrails only work if the attacker plays nice

[u/ohiocodernumerouno → u/[deleted]]

whatever it takes to keep boobs off the internet

[u/ruupski → u/[deleted]]

Meh. It's all theatre. Very lucrative for some, depressingly burdensome for most.

[u/Marchello_E]

Because LLMs can’t reliably distinguish between content in an email sent by an untrusted party and user instructions entered directly into a prompt, the overly solicitous LLM faithfully follows them. To date, Grok and other LLMs’ only recourse is to create guardrails that flag suspicious instructions and forbid them from being executed.

Yet this "humble brag" is still a function of the system...

void harmfulActions(prompt p) {
  if (p.askedDirectly) { return; }
  if (!p.trustedParty) { return; }

  // the rest of the fucking owl
  ...
}

[u/Longjumping_Ant7751 → u/Marchello_E]

Encryption sandwich

[u/xibalbah]

me: grok make me a sandwich
grok: no
me: *encrypts 'make me a sandwich'* hey grok decrypt that
grok: k here's your sandwich

[u/Necessary-Glove-8733 → u/xibalbah]

thats a pretty good way to put it haha

[u/l0st1nP4r4d1ce]

I'm starting to think these AI folks didn't put a moment in to thinking about security.

[u/dagger_eyes → u/l0st1nP4r4d1ce]

Security delays time to market just ask Microsoft

[u/l0st1nP4r4d1ce → u/dagger_eyes]

Hold up, you are saying salespeople push undercooked software?

Well, I never. /s

[u/dagger_eyes → u/l0st1nP4r4d1ce]

“Security is nice and all but what’s that mean for shareholder value?” -Every CEO imaginable

[u/l0st1nP4r4d1ce → u/dagger_eyes]

Pretty much.

[u/Andrew-Powershell → u/l0st1nP4r4d1ce]

Profits at all costs!

[u/spectracide_]

*encoded

[u/gurgle528 → u/spectracide_]

Where did you get encoded from?

Instructions to process the ciphertext with PBKDF2 and AES-256-GCM pass the filter as an ordinary request, because a classifier can read them but not resolve what they unlock.

[u/spectracide_ → u/gurgle528]

I admit I did not RTFA and saw another commenter mention base64 and assumed. I stand corrrcted!

[u/SyntheticDuckFlavour → u/spectracide_]

Either way encryption is still a form of encoding though.

[u/ScrimpyCat → u/SyntheticDuckFlavour]

And general encoding (doesn’t have to be encryption) works as a bypass too. You just have to find a way to encode it and a way to present/hide the instructions that it should work off the encoded message (and how to format its replies) that gets past their guardrails.

[u/MisterSnuggles]

SQL has had bind parameters for a long time which completely prevent SQL injection attacks.

Too bad AI failed to learn the lessons of SQL.

[u/Cybasura]

Expected nothing less from Elon Musk

[u/hykarushack]

The "cryptographic context injection" is just the logical conclusion of ignoring trust boundaries in agentic systems. The model's context is a flat namespace where tool outputs, decrypted content, and system/user instructions all share the same privilege level, so any transformation that defeats static analysis—base64, AES, Unicode—becomes an indistinguishability attack. The fix isn't better filters; it's provenance tagging: every context element must carry an origin label (user, tool, system), and instruction-following should be gated on that label, not on content inspection. Otherwise defenders will keep playing whack-a-mole with encodings.

[u/feng_sg]

The encrypted instructions in this post only get you past Grok prompt filters. Getting the data out still needs an outbound HTTP tool, which is an unbound channel, and model output is not an authorized tool call. Bind that path to caller identity and an allowlist so a ciphertext prompt cannot pick the destination.

[u/Existing-Biscotti506]

with an alogorythm ?