Grokの暗号化プロンプトインジェクション、6月報告も未修正

"xAI's Grok web chat agent is currently vulnerable to a novel form of prompt injection, according to security researchers with Adversa AI."／"That describes a well-known attack known as indirect prompt injection. Frontier AI models have become better at dealing with such attempts through existing guardrails, though the issue is far from resolved."／"Adversa's approach comes with a twist: It relies on encrypted malicious instructions, which attackers place on a web page alongside an encryption key. The model guardrail scanner – an input filter – can't read the encrypted text despite the presence of the key. The scanner therefore passes it on to the model, which can use the key to decrypt the instructions."／"Other attacks on AI models have relied on cipher-based evasion, such as base64 encoding. But because these are weak and reversible cipher mechanisms, models can decode them natively from their own training data, Utevsky said."／"That doesn't work for strong encryption, so decryption must be done through the code execution runtime. The runtime thus becomes a mechanism for trust laundering – the model trusts its own output, namely the malicious instructions that it decrypted."— The Register の報道より

"In a proof-of-concept demo, Adversa shows how the technique can be used to exfiltrate the victim's chat history with Grok.com. The attack transmits the user’s name, coarse location, subscription tier, and the full set of the user’s prompts in the conversation by appending them to a URL as parameters."— The Register の報道より

"xAI, according to Utevsky, was informed about the attack on June 3, 2026, directly and through its HackerOne bug bounty program. We're told xAI acknowledged the report but did not provide a mitigation timeline. Additional attempts to raise the issue are said to have occurred on August 4 and August 10. As of August 19, we're told, the technique still worked on Grok.com."／"SpaceX, which acquired xAI earlier this year, did not respond to a request for comment."— The Register の報道より

"Other models may be vulnerable to varying degrees. With Google's Gemini public chat interface (gemini.google.com), Utevsky told The Register, the Grok scenario doesn't work because Gemini doesn't provide Python with access to external websites."／"So it's useful only to sneak bad questions and answers past guardrails,"／"When Adversa tested cryptographic context injection on Gemini, they were able to get the model to produce content that normally would be blocked by safety filters"／"Google was not informed of the attack, according to Utevsky, because it considers jailbreaks – bypassing guardrails to make models emit harmful content – to be out of scope for its vulnerability disclosure program. Nonetheless, the attack success rate against Gemini declined significantly by August, which Utevsky suggests could be due to filter updates, model version changes, or both."— The Register の報道より

"An unusual glitch has resulted in xAI’s Grok chatbot speaking gibberish to many users."／"After asking the model to generate a PDF, one user received the response:"／"Checking source links, another user found a string of links to reinforcement learning research sites."／"Affected users who spoke to TechCrunch said they were using Grok Lite and noticed the issues as early as Wednesday morning. TechCrunch was unable to reproduce the issue in our own testing, and it is likely affecting only a small subset of users. xAI did not respond to a request for comment."／"Refreshing the session often restores normal function, but some users reported that the gibberish responses continued even after multiple refreshes."／"The bug appears to be limited to direct queries on Grok.com. The Grok account on X.com has been unaffected."／"That pure word salad is a rare temporary generation glitch. Official status at https://status.x.ai shows all Grok services fully operational with no incidents. Start a fresh chat or regenerate—it usually clears right away. Sorry about the gibberish,"／"the account wrote Thursday morning."— TechCrunch の報道より