Independent researchers demonstrated prompt-injection attacks against the Grok family, including instructions encrypted on a page alongside their own decryption key so that scanners see ciphertext while the model decrypts and acts.

NotesThe manual is explicit that this finding was against Grok's web chat rather than Grok Bot and should not be reported as a Grok Bot vulnerability; the disclosure record (reported early June 2026, still unpatched in late August by the researchers' account) is the useful signal. via: grok-bot-operators-manual (2026-09-02)