Israeli researchers reveal severe security vulnerabilities in xAI's Grok AI agent

In depth

Israeli cybersecurity firm Profero has disclosed a series of security vulnerabilities in xAI's Grok AI agent. The vulnerabilities could allow attackers to take over the work environment and steal sensitive information. The company counts eight vulnerabilities, and according to the findings they include a default password, storage of login credentials in plain text, and bypassing of encryption mechanisms.

According to the findings, servers can be taken over without the need to inject code or external malware. The researchers approached xAI and Cursor, but according to them the companies chose to ignore the findings. According to the researchers, the relevant companies were already updated in August, and the flaws remain unaddressed.

Grok Bot is the AI agent from xAI, owned by Elon Musk. Many organizations operate AI agents to carry out complex tasks and share sensitive information with them, so these vulnerabilities are relevant to organizations using the tool.