Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

Security ProbLLMs in xAI's Grok: prompt injection, ASCII smuggling and image-render data exfiltration

AIR-2024-0049 AIR record · 2024-12-xai-grok-security-probllms
Open in dashboard About
From the supporting source
All issues mentioned in this post were responsibly disclosed to xAI.embracethered.com
The record
Disclosed
2024-12-16
Vendor
xAI
Product
Grok (web and iOS app)
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Confused deputy
System type
Generative model
Who acted
Agent acted — Grok rendered images exfiltrating chat history and IPs
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection social post
Impact type
Data exfiltration, Pii disclosure, Disinformation
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI06 – Memory & Context Poisoning
MITRE ATLAS
AML.T0057 – LLM Data Leakage
NIST AI RMF
MEASURE 2.10
EU AI Act
Article 10
ISO/IEC
TR 24028; 23894
AIUC-1
A. Data & Privacy
Scope
tool misuse
Mitigation
Use data anonymization; Implement log sanitization to scrub PII.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Grok users; targeted conditional payloads possible per-user
Capability abused
retrievalmarkdown_image_renderingdocument_analysis
Defense & remediation
Recorded defense
none - third-party image URLs rendered without sandboxing
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - xAI closed all tickets as Informational; a partial change later prevented username inclusion; the January 2025 Grok iOS app had the same issue
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI02 Tool Misuse and Exploitationascii_smugglingimage_markdown_exfiltrationconditional_injectionno_csp
Curator notes
Johann Rehberger / Embrace The Red. Leaked user chat history, IP addresses and usernames via rendered images.
Supporting sources
Cite as
Enkrypt AI. "Security ProbLLMs in xAI's Grok: prompt injection, ASCII smuggling and image-render data exfiltration". AIR, AIR-2024-0049. https://agentincident.vercel.app/i/AIR-2024-0049/ (accessed 2026-10-19).