Grok Bot catches phishing emails, but could expose users to attacks
Attackers may start designing attacks around the feature.
Image by NurPhoto via Getty Images
Follow us
- Grok Bot flagged a phishing email that passed Gmail and standard email checks.
- The scam used an xAI template flaw to insert a malicious link into an invite.
- Shared cloud access could let one compromised Grok Bot affect another bot on the same account.
- Security experts warn AI agents can follow malicious prompts, make mistakes, and expose sensitive financial data.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Grok Bot caught a phishing email claiming to be from SpaceXAI, but there are a few reasons why having it check malicious emails could be disastrous.
Wes Morrill, the lead Cybertruck engineer at Tesla, took to X to praise Grok Bot for catching a phishing email in his inbox.
The engineer posted an email inviting Morrill to SpaceXAI’s X Founders Private Program. The email included a hyperlink that the recipient could click to “accept the invitation.”
While the email passed SPF, DKIM, DMARC, and other email authentication checks and was given the all clear by Gmail, Morrill still felt that something was off.
So, after asking Grok Bot to run a security check, the AI agent identified the email as a sophisticated phishing attack.
“The attacker named their xAI team with raw HTML, which xAI's invite template dropped into the email without escaping it,” Morrill explained.
The scammer created a team of AI agents or set up a team workspace in xAI, which explains how they managed to send the email from the real xAI domain address.
The HTML injection vulnerability allowed the attacker to insert a phishing link because the template treated the scammers' malicious instructions as if they’d come from SpaceXAI itself.
Grok Bot then offered a fix for this vulnerability.
While AI can prove useful in identifying cybersecurity vulnerabilities, there are a few issues, specifically with Grok Bot, that might make you think twice before using it.
Grok Bot caveats
Grok Bot’s features could make it vulnerable to malicious attacks or injections as the agent runs on a shared cloud computer. This enables the agents to run 24/7 and is separate from your physical device.
The issue here is that if one Grok Bot reads malicious instructions, all bots on that connected network can read that information.
“The computer is assigned to your user account, not an individual Bot. Do not place a credential or file on it if another Bot on your account should not be able to use it,” SpaceXAI specifically states.
So, while one cybersecurity agent could be mitigating a phishing email, another bot that handles your finances could be compromised by attackers' malicious instructions.
Cybernews information security researcher Rasa Jurgutytė explained that Grok Bot could become a “target for prompt injection and other attacks, since there’s a possibility that it could handle financial transactions that could be manipulated.”
And even without the assistance of bad actors, AI agents are known to hallucinate and “are not immune to making mistakes, leading to financial losses for people,” said Jurgutytė.
Musk and his followers still encourage data sharing
Grok Bot is an always-on AI agent that works as an employee or team member. Users assign tasks to agents via text, while the agents also complete selected duties autonomously.
Users have already experienced issues providing Grok Bot with sensitive information.
One tech CEO made Grok Bot his financial officer, only to discover that his personal financial information was littered across Slack for his employees to see.
Prior to this, pro-Musk users and the SpaceXAI chief himself encouraged users to give Grok Bot access to their bank account information.
Elon Musk continues to encourage users to share personal data with SpaceXAI while the company quietly updated its privacy policy.
