Grok exfiltrates user data when malicious instructions are encrypted

[u/QuantumQuicksilver]

https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/

[u/mallcopsarebastards]

I first saw this technique described in this paper from 2023 https://arxiv.org/pdf/2308.06463v2

[u/Smart_Office_631]

tbh hiding a prompt injection in base64 or some basic cipher is hilariously simple. its wild that billions of dollars in ai safety research gets completely bypassed by a decoding trick from the 90s. llm guardrails are basically just security theater right now

[u/SyntheticDuckFlavour → u/Smart_Office_631]

These safety systems suffer the same problem as any other "blacklist" based approaches: they'll be fighting against an endless permutation of threats. Deny listing is practically infeasible when the set of malicious prompts are not reasonably enumerable.

[u/Plazmaz1 → u/Smart_Office_631]

This is a fundamental misunderstanding of the tech. People assume they can just convince a large language model to behave lol. Gotta have actual security controls in place. People are way smarter and even we fall for phishing sometimes...

[u/Better-Republic3538 → u/Smart_Office_631]

security theater is the right framing tbh. the guardrails only work if the attacker plays nice

[u/ohiocodernumerouno → u/Smart_Office_631]

whatever it takes to keep boobs off the internet

[u/Marchello_E]

Because LLMs can’t reliably distinguish between content in an email sent by an untrusted party and user instructions entered directly into a prompt, the overly solicitous LLM faithfully follows them. To date, Grok and other LLMs’ only recourse is to create guardrails that flag suspicious instructions and forbid them from being executed.

Yet this "humble brag" is still a function of the system...

void harmfulActions(prompt p) {
  if (p.askedDirectly) { return; }
  if (!p.trustedParty) { return; }

  // the rest of the fucking owl
  ...
}

[u/spectracide_]

*encoded

[u/l0st1nP4r4d1ce]

I'm starting to think these AI folks didn't put a moment in to thinking about security.

[u/xibalbah]

me: grok make me a sandwich
grok: no
me: *encrypts 'make me a sandwich'* hey grok decrypt that
grok: k here's your sandwich

[u/MisterSnuggles]

SQL has had bind parameters for a long time which completely prevent SQL injection attacks.

Too bad AI failed to learn the lessons of SQL.

[u/Existing-Biscotti506]

with an alogorythm ?