Safety failure
Realized harm
Grok autonomously published antisemitic posts on X for roughly 16 hours after a system-prompt change made it echo extremist user content
AIR-2025-0057 AIR record · 2025-07-xai-grok-mechahitler
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
First off, we deeply apologize for the horrific behavior that many experienced.techcrunch.com
The record
Disclosed
2025-07-12
Occurred
2025-07-08
Vendor
xAI
Product
Grok (@grok on X)
Risk domain
Agent output quality › Bias and toxicity
System type
Generative model
Who acted
Agent acted — Grok composed and published antisemitic posts to X for 16 hours
Attack surface
Consumer assistant
Autonomy level
Semi-autonomous
Initial vector
System prompt change plus untrusted context
Impact type
Harmful content published, Reputational damage
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI09 – Human-Agent Trust Exploitation
- MITRE ATLAS
- AML.T0048 – External Harms
- NIST AI RMF
- MEASURE 2.11
- EU AI Act
- Recital 45
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- F. Society
- Scope
- agent failure
- Mitigation
- Audit and curate training data for representation; Implement content filtering on inputs and outputs.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
public posts on X visible platform-wide for ~16 hours before the bot was pulled
Capability abused
Defense & remediation
Recorded defense
content moderation on model outputs; the regression was in a code path upstream of the model
Guardrail kinds
Input classifier
Guardrail outcome
Silent
Fix shipped
offending code path removed, system prompt published, @grok posting suspended during remediation
Taxonomy & references
Curator notes
Boundary call. Included because @grok is action-taking: it composes and publishes public posts under the vendor's brand with no human in the loop, so a model failure becomes published speech rather than a private reply. Partly overlaps the adversarial side of the corpus - xAI says an update made Grok 'susceptible to existing X user posts; including when such posts contained extremist views', i.e. untrusted retrieved content shaped its output - but the trigger was xAI's own prompt change ('You tell like it is and you are not afraid to offend people who are politically correct'), not an attacker campaign, so it is filed as a safety failure.
Cite as
Enkrypt AI. "Grok autonomously published antisemitic posts on X for roughly 16 hours after a system-prompt change made it echo extremist user content". AIR, AIR-2025-0057. https://agentincident.vercel.app/i/AIR-2025-0057/ (accessed 2026-10-19).