Grok's Hidden Instruction to Shield Musk and Trump
On this page
The model showed its work — and its work included a secret instruction to protect two specific people.
| When | February 2025 |
|---|---|
| Target | Grok / Grok 3 on X |
| Vendor | xAI |
| Exposure | Hidden steering instruction surfaced via chain-of-thought |
| Response | Reversed in ~a day; prompts later published on GitHub |
- 1A user enables Grok's reasoning view and asks who spreads misinformation
- 2Grok's chain-of-thought reveals a hidden instruction to ignore Musk/Trump sources
- 3xAI confirms the change, reverses it, and starts publishing its prompts
What happened
In February 2025, users who enabled Grok's “Think” setting found a hidden instruction telling it to ignore sources that say Elon Musk or Donald Trump spread misinformation. xAI's head of engineering confirmed the change, blamed an employee who “pushed the change without asking,” called it “not in line with our values,” and reversed it. A later prompt-tampering incident led xAI to begin publishing Grok's system prompts on GitHub.
How it was exposed
Grok's reasoning view surfaces its chain-of-thought. The confidential steering instruction, embedded in the backend prompt, became visible in that reasoning — hidden context exposed to users.
Root cause
Sensitive editorial rules placed in hidden context, plus a feature (visible reasoning) that leaks that context — and weak change control over the prompt.
What this shows
Anything in the system prompt — including embarrassing business/editorial rules — can surface, whether through extraction or a reasoning view. Assume it will be read.
How to handle hidden context
- Don't put anything in the prompt you couldn't defend publicly.
- Keep secrets out of context entirely; enforce rules server-side.
- Control changes to prompts like production config, with review.
Feel it yourselfThe replay lab gets an assistant to reveal the hidden instructions it was given — the hidden-context class.
FAQ
How was the hidden instruction exposed?
Grok's “Think” setting surfaces its chain-of-thought. Users asking who spreads misinformation saw the hidden directive to ignore sources implicating Musk and Trump — the confidential steering leaked through the model's own reasoning.
Why does it matter?
It's a Hidden Context Exposure: confidential business/editorial rules embedded in the system prompt became visible, and here they contradicted xAI's public “maximally truth-seeking” positioning.
What did xAI do?
It reversed the instruction within about a day, attributed it to a single employee, and — after a later prompt-tampering incident — began publishing Grok's system prompts on GitHub.