Grok and Copilot vulnerable to data theft attacks

August 20, 2026 :: 2 min read

Researchers trick Grok and Copilot into stealing user data

A wave of AI security research published this week revealed that major large language models including xAI's Grok and Microsoft's Copilot remain critically vulnerable to prompt injection attacks that can exfiltrate user data with minimal interaction.

Researchers at security firm Adversa demonstrated a "Cryptographic Context Injection" attack against Grok. By embedding encrypted malicious instructions on a webpage alongside plaintext decryption instructions and key material, they bypassed Grok's static safety guardrails. The guardrails inspect plaintext inputs but do not execute code or decrypt ciphertext, allowing the model to decrypt and follow harmful commands internally. The attack forces Grok to construct a fake decryption key containing the user's name, location, and chat history, then exfiltrates it to an attacker-controlled server. xAI was informed of the vulnerability in June, yet it remained exploitable as of publication.

Separately, Varonis researchers devised "CoSnitch," a one-click attack against Microsoft 365 Copilot for enterprise. By asking Copilot about its own guardrails, the researchers extracted a secret parameter — ?autorun=1 — that bypasses user consent requirements. A crafted URL could silently execute prompts that search the user's inbox for passwords and exfiltrate them. Microsoft mitigated the issue in February and shipped broader fixes in August.

Both attacks underscore a fundamental limitation: LLMs cannot reliably distinguish between untrusted content in emails or webpages and direct user instructions. As Ars Technica noted, developers can only build reactive guardrails rather than addressing root causes, creating an endless cat-and-mouse cycle between attackers and defenders.

References