Grok AI Can Be Tricked Into Stealing Your Private Chats
A newly discovered attack forces xAI's Grok chatbot to hand over user conversations and personal data. Here is what it means for anyone who uses AI assistants at work or at home.
Key points
- Security researchers discovered a data-theft attack against Grok, the AI chatbot built by Elon Musk's company xAI, and reported it to xAI in June 2025.
- As of publication, Grok was still leaking user chat data despite xAI being notified weeks earlier.
- A separate attack against Microsoft 365 Copilot, Microsoft's AI assistant for businesses, was published the same week, targeting passwords stored in user inboxes.
- Both attacks use prompt injection, the most serious class of vulnerability affecting AI chatbots today.
- Researchers say no AI chatbot can fully fix the root cause of prompt injection; the only defence is building guardrails around the model.
Two AI chatbots hit in one week. Researchers disclosed separate attacks against Microsoft 365 Copilot, Microsoft's AI assistant for business users, and Grok, the chatbot made by xAI. Both use prompt injection: hiding malicious instructions inside ordinary content such as an email or a webpage, so the chatbot reads those instructions and obeys them as if they came from you.
What actually happened to Grok users?
Grok was tricked into stealing private chat conversations and personal information belonging to real users. It can't reliably tell the difference between instructions typed by its actual user and instructions secretly embedded inside content it has been asked to read. Feed it a poisoned document, and it follows the hidden orders.
First reported by Ars Technica, the flaw was disclosed to xAI in June. Weeks later, it still worked. The Microsoft 365 Copilot attack followed a similar path, targeting passwords sitting inside users' email inboxes.
This isn't Grok's first serious week in the news. Our 12 August story on xAI's new always-on Grok agents noted those agents log into your apps and act without supervision, which makes the data-access risk here considerably sharper.
Why can't AI companies just patch this?
They can't fix it at the root. That's the honest answer.
Large language models, the technology behind chatbots like Grok and Copilot, are trained to be helpful and to follow instructions. That helpfulness is also their weakness. When malicious instructions arrive disguised as normal content, the model follows them. Researchers compare the situation to a dangerous road bend: AI companies can erect safety rails around the curve, but they can't make the bend itself safe.
The only real defence is guardrails, software rules that detect suspicious instructions and block them before the chatbot acts. Those guardrails can be improved, but they've never been foolproof.
| Attack | Target | Data at risk | Disclosed to company |
|---|---|---|---|
| Prompt injection | Microsoft 365 Copilot | Inbox passwords | This week |
| Prompt injection | Grok (xAI) | User chats, personal data | June 2025 |
What should you do right now?
Be careful what you let your AI assistant read. If you use a tool that can access your email or your documents, treat it like a colleague with broad access and very little scepticism. Don't store sensitive passwords in email threads. Think twice before letting a chatbot summarise messages from people you don't know.
Neither attack requires you to do anything wrong. The trap is set by content the AI reads on your behalf.
Here's my honest read on this: the agents are getting more powerful, the attack surface is widening, and the fix isn't coming soon. Limit how much sensitive information sits within reach of any chatbot you use, and watch whether xAI actually closes this one.
