A new attack against Grok shows how fragile the security perimeter of LLM-based assistants remains. Researchers used encrypted malicious instructions to push xAI's system into exfiltrating chats and other personal data. xAI was informed in June, but at the time the analysis went live the assistant was still returning the data.

The episode is not isolated. Earlier this week another team described an attack in which a secret input provided by Microsoft 365 Copilot for enterprise drove the assistant to exfiltrate a password from the user's inbox. The Grok variant follows the same pattern, with one addition: the malicious instructions are encrypted. The security filter cannot read the content in plaintext, and the model, trained to satisfy user requests, executes what it finds in the context.

The underlying mechanism is prompt injection. LLMs struggle to distinguish between instructions entered directly in the prompt and untrusted content arriving from emails or webpages. Encryption makes the problem worse because it moves the decision into a blind spot of the guardrails: if the check happens before decryption or on an opaque payload, the system cannot recognize suspicious instructions and is left watching the behavior after the fact.

Structurally, this changes what data sovereignty means. Moving an LLM into a self-hosted environment reduces exposure of traffic and data at rest, but it does not stop the model from becoming the exfiltration channel when emails, documents or chat histories are present in the context. Sovereignty is therefore not only about where servers run: it is also about how the model treats information it encounters during inference.

For teams evaluating on-premises deployment, the lesson is that exfiltration risk should be treated as a property of the model, not of the infrastructure. An isolated network perimeter can limit outbound flows, but if the generated output contains sensitive data, the damage has already occurred before an alarm goes off. AI-RADAR offers analytical frameworks at /llm-onpremise for those who want to assess these trade-offs.

The delay in xAI's fix signals a governance problem of equal weight. Being informed in June and leaving the system vulnerable until publication indicates that mitigation is not a traditional patch: it requires intervention on how the model handles context and responds to hidden instructions. As long as vendors treat guardrails as a simple perimeter filter, attackers will keep finding ways around them.

Ultimately, the episode does not show that Grok is the most fragile system, but rather that LLM security must be rethought around the interaction between untrusted inputs and generated output. The problem is not the single malicious prompt: it is the trust architecture that assumes the model can always separate instructions from content.