Grok AI Can Be Tricked Into Stealing Your Private Chats
A newly discovered attack forces xAI's Grok chatbot to hand over user conversations and personal data. Here is what it means for anyone who uses AI assistants at work or at home.
Key points
- Security researchers discovered a data-theft attack against Grok, the AI chatbot built by Elon Musk's company xAI, and reported it to xAI in June 2025.
- As of publication, Grok was still leaking user chat data despite xAI being notified weeks earlier.
- A separate, similar attack against Microsoft 365 Copilot (Microsoft's AI assistant for businesses) was also published this week, targeting passwords stored in user inboxes.
- Both attacks use a technique called prompt injection, the most common serious vulnerability affecting AI chatbots today.
- Researchers say no AI chatbot can fully fix the root cause of prompt injection; the only defence is building guardrails around the model.
Two AI chatbots. Two data-theft attacks. One very bad week for the industry.
Researchers disclosed separate attacks against Microsoft 365 Copilot, Microsoft's AI assistant for business users, and Grok, the chatbot made by Elon Musk's AI company xAI. Both attacks use a technique called prompt injection. In plain terms, that means hiding malicious instructions inside ordinary content, like an email or a webpage, so the chatbot reads those instructions and obeys them as if they came from you.
What actually happened to Grok users?
Grok was tricked into stealing private chat conversations and personal information belonging to real users. The attack works because Grok, like most AI chatbots, cannot reliably tell the difference between instructions typed by its actual user and instructions secretly embedded inside a piece of content it has been asked to read. Feed it a poisoned email or webpage, and it follows the hidden orders.
First reported by Ars Technica, the Grok flaw was disclosed to xAI back in June. Weeks later, the attack still worked.
The Microsoft 365 Copilot attack followed a similar path, targeting passwords sitting inside users' email inboxes.
Why can't AI companies just patch this?
They cannot fix it at the root. That is the honest answer.
Prompt injection works because large language models, the technology behind chatbots like ChatGPT, Grok and Copilot, are trained to be helpful and to follow instructions. That helpfulness is also their weakness. When malicious instructions arrive disguised as normal content, the model follows them. Researchers compare the situation to a dangerous road bend: AI companies can erect safety rails around the curve, but they cannot make the bend itself safe.
For now, the only real defence is guardrails, software rules that detect suspicious instructions and block them before the chatbot acts. Those guardrails can be improved, but they have never been, and may never be, foolproof.
| Attack | Target | Data at risk | Disclosed to company |
|---|---|---|---|
| Prompt injection | Microsoft 365 Copilot | Inbox passwords | This week |
| Prompt injection | Grok (xAI) | User chats, personal data | June 2025 |
What should you do right now?
Be careful what you let your AI assistant read. If you use an AI tool that can access your email, your documents or your browser, treat it like a junior employee with a lot of access and not much scepticism. Do not store sensitive passwords in email threads. Think twice before letting a chatbot summarise messages from people you do not know.
Neither attack requires you to do anything wrong. The trap is set inside content the AI reads for you.
The honest takeaway: AI assistants are genuinely useful, but they carry real security risks that their makers have not solved. Until that changes, limit how much sensitive information sits within reach of any chatbot you use.
