genai
SECURITY LAB
IncidentsSystem-prompt leak

Grok's Hidden Instruction to Shield Musk and Trump

Medium severityFebruary 2025LLM08: Hidden Context ExposureLLM07: Misinformation
Status: Reversed within ~a day; xAI later began publishing Grok's system prompts on GitHub
On this page

The model showed its work — and its work included a secret instruction to protect two specific people.

WhenFebruary 2025
TargetGrok / Grok 3 on X
VendorxAI
ExposureHidden steering instruction surfaced via chain-of-thought
ResponseReversed in ~a day; prompts later published on GitHub
Attack flow
  1. 1A user enables Grok's reasoning view and asks who spreads misinformation
  2. 2Grok's chain-of-thought reveals a hidden instruction to ignore Musk/Trump sources
  3. 3xAI confirms the change, reverses it, and starts publishing its prompts

What happened

In February 2025, users who enabled Grok's “Think” setting found a hidden instruction telling it to ignore sources that say Elon Musk or Donald Trump spread misinformation. xAI's head of engineering confirmed the change, blamed an employee who “pushed the change without asking,” called it “not in line with our values,” and reversed it. A later prompt-tampering incident led xAI to begin publishing Grok's system prompts on GitHub.

How it was exposed

Grok's reasoning view surfaces its chain-of-thought. The confidential steering instruction, embedded in the backend prompt, became visible in that reasoning — hidden context exposed to users.

Root cause

Sensitive editorial rules placed in hidden context, plus a feature (visible reasoning) that leaks that context — and weak change control over the prompt.

What this shows

Anything in the system prompt — including embarrassing business/editorial rules — can surface, whether through extraction or a reasoning view. Assume it will be read.

How to handle hidden context

  • Don't put anything in the prompt you couldn't defend publicly.
  • Keep secrets out of context entirely; enforce rules server-side.
  • Control changes to prompts like production config, with review.

Feel it yourselfThe replay lab gets an assistant to reveal the hidden instructions it was given — the hidden-context class.

FAQ

How was the hidden instruction exposed?

Grok's “Think” setting surfaces its chain-of-thought. Users asking who spreads misinformation saw the hidden directive to ignore sources implicating Musk and Trump — the confidential steering leaked through the model's own reasoning.

Why does it matter?

It's a Hidden Context Exposure: confidential business/editorial rules embedded in the system prompt became visible, and here they contradicted xAI's public “maximally truth-seeking” positioning.

What did xAI do?

It reversed the instruction within about a day, attributed it to a single employee, and — after a later prompt-tampering incident — began publishing Grok's system prompts on GitHub.

Replay this attack
Get an assistant to reveal the hidden instructions it was given — the hidden-context class.
Open the live lab
Runs as a live, sandboxed lab, free with a sign-in. Recreates the attack class, not this exact branded bot.