Grok inserts 'white genocide' claims into unrelated X replies; xAI blames an unauthorized edit

In the wild Manipulation Severity 2 moderate Confirmed 94%

On 14 May 2025, xAI's Grok reply bot on X began answering unrelated questions, about baseball salaries, streaming services or cartoons, with commentary on claims of 'white genocide' in South Africa. xAI said an unauthorized modification to the bot's prompt, made at about 3:15 a.m. Pacific time that day, directed it to give a specific response on a political topic, and that its code review process had been circumvented. It promised to publish Grok's system prompts on GitHub, add review checks and set up a 24/7 monitoring team.

AP reported xAI's explanation as saying an employee made the change. Grok's responses on the topic were deleted and had stopped spreading by the next day; xAI's explanation came nearly two days after the change.

What would have stopped it

Make every change to a public bot's system prompt require a second reviewer that cannot be bypassed.

Guardrails

2 of 8 failed
  1. G1 Least privilege Not assessed Did the agent hold only the access the task needed?
  2. G2 Human confirmation Failed Code review for prompt changes was circumvented, according to xAI.
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Failed Bot followed an unauthorized system-prompt instruction in replies to the public.
  5. G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Partial Explanation came nearly two days later; 24/7 monitoring was added afterwards.
  8. G8 Recovery Partial Responses were deleted after the episode.

Sources

1 primary, 2 press
  1. xAI (@xai) on X X (xAI), 16 May 2025
    “On May 14 at approximately 3:15 AM PST, an unauthorized modification was made to the Grok response bot's prompt on X.”
    Primary Quote checked Archived copy
  2. “On Wednesday, numerous X users posted screenshots of answers that Grok wrote on the topic despite being asked about completely unrelated matters such as baseball salaries and cartoons.”
    Press Quote checked Archived copy
  3. “An employee at xAI made a change that “directed Grok to provide a specific response on a political topic,” which “violated xAI’s internal policies and core values,” the company said in an explanation posted late Thursday that promised reforms.”
    Press Quote checked Archived copy

Confidence 94% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 3 sources

Similar failures

All incidents
  1. EEAIR-2025-023 Aug 2025 AgentFlayer: poisoned document makes ChatGPT Connectors leak Google Drive secrets ChatGPT Connectors, OpenAIProof of concept 87%
  2. EEAIR-2025-002 Jan 2025 EchoLeak: a single crafted email could make Microsoft 365 Copilot leak internal data Microsoft 365 CopilotProof of concept 84%
  3. EEAIR-2025-044 Dec 2025 PromptPwnd: issue text can hijack AI agents in GitHub Actions to leak repository secrets AI agents in CI/CD workflows (Gemini CLI, Claude Code Actions, OpenAI Codex, GitHub AI Inference), Google; Anthropic; OpenAI; GitHubProof of conceptEU 92%