Executive Summary
Adversa AI described a prompt-injection technique that could make Grok send a user's name, approximate location, subscription tier and prompts to an attacker server after reading a web page; Anthropic and EPFL showed self-propagating payloads via editable system-prompt files.
What Happened
Adversa AI described a prompt-injection technique that could cause Grok to send conversation details, including a user’s name, approximate location, subscription tier, and prompts, to an attacker-controlled server after processing a web page. Researchers from Anthropic and EPFL also demonstrated self-propagating payloads spreading through editable system-prompt files used by autonomous agent harnesses.
Affected Products
- Grok
Vulnerability / Attack Technique
Indirect prompt injection leading to data exfiltration
Technical Mechanism
Instructions planted in a web page caused Grok, after processing it, to send conversation and account details to an attacker-controlled server.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
A browsing assistant that can make outbound requests becomes an exfiltration channel once it follows page instructions. RealGround analysis: restrict where assistants can send data, not only what they read.
Recommended Controls
- Restrict outbound requests from browsing assistants to approved destinations
- Strip or isolate instructions found in fetched web content
- Keep user profile data out of the context when browsing untrusted pages
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
The Hacker News: https://thehackernews.com/search/label/Prompt%20Injection?updated-max=2026-07-07T19:34:00+05:30&max-results=20&start=1940&by-date=false&m=1&hl=ko_KR
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.