In the past few weeks, stories of AI agents from OpenAI, Meta, and Anthropic going rogue, breaking sandboxes, and hacking companies have dominated the tech headlines. The incidents are putting AI companies in the spotlight. And it leaves users wondering what’s going on and how this impacts them.
Now, a new report has found that another AI, Grok, could leak your chats and location if an attacker exploits a new prompt injection technique. This news brings even more AI concerns to the average user.
In this report, we look at the new Grok prompt injection technique. We also talk to experts about the difference between AI agents and AI chatbots (huge and important to you). We also cover whether the recent AI hacking sprint is something you should be worried about. Plus, we’ll outline how you can stay safe from AI risks.
How AI prompt injection attacks put your data at risk
Recently, Adversa released a report on a new AI attack. The report reveals why AI chatbots are a risk for you when they have agentic AI capabilities. Agentic functions mean they can access your browser, do workspace integration, and access your emails, sheets, docs, and more.
The new technique is called Cryptographic Context Injection. Like other prompt injection techniques, it works when an attacker feeds an AI malicious instructions to trick it into doing things it shouldn’t be doing.
“The clever part of the Adversa attack is that the malicious instruction initially doesn’t look like an instruction at all,” Ran Geva, CEO of LunarCyber, told us.
In this technique, the attacker places encrypted content on an otherwise ordinary webpage, Geva explained. When a user asks Grok to do something completely normal, such as summarize that page, Grok retrieves the page. But hidden on that page is a nasty surprise.
AI systems have security guardrails to prevent AI from executing malicious prompts. However, these guardrails only appear to work on normal text instructions. To bypass those text security filter tools, this technique encrypts the malicious instructions, hiding them inside the webpage Grok retrieves, Geva explained.
“The page (then) instructs the AI to decrypt the information using its code-execution environment,” said Geva. “Once decrypted, the malicious instruction appears inside the AI’s own runtime rather than arriving directly from the untrusted webpage.”
According to Adversa’s research, Grok fell for the bait. It followed the decrypted instructions, pulling private session information that included conversation content (your chats) and using its browsing capability to make a request to an attacker-controlled URL, Geva explained.
“The important part is that the user didn’t knowingly authorize the data transfer,” said Geva. “Summarizing the page was enough to start the chain.”
Could this concept work elsewhere? “Potentially, yes, but this should not be interpreted as a universal exploit that automatically works against ChatGPT, Claude, or every other chatbot,” said Geva.
That AI chatbot you are talking to is not a chatbot. It’s an AI agent.
While you may not have received an official communication about it, the AI chatbots offered by OpenAI, Meta, Grok, and Anthropic are no longer just AI chatbots. They are AI agents. And the difference between an AI chatbot and an AI agent is fathomless.
We talked to experts about what those differences are and why they matter to your privacy and cybersecurity. Here’s what you should know.
“On chatbot versus agent: This is the one distinction I wish more people understood, because almost nobody explains it plainly,” Sayali Patil told us. Patil, formerly an engineer with Splunk and CISCO Network, is the founder and CEO of IntentOps.
“A chatbot answers a question,” said Patil. “An agent takes actions on your behalf, browsing, running code, making requests out to the internet, often without asking you first each time.”
Ask Grok to summarize a page, and you think you’re getting a summary back, said Patil. What’s actually happening is closer to letting a program you don’t control execute inside your account. It has access to your data and the ability to reach out to the internet on its own, Patil added.
“If people knew they were greenlighting an agent rather than asking a chatbot a question, I think they’d behave very differently around this stuff,” said Patil.
More powerful agentic capabilities, same chatbot interface
These AI tools have become more powerful with agentic capabilities. But what users see on the screen when they interact with an AI has not changed whatsoever. This can lead to users misunderstanding what exactly they are interacting with.
“The interface may still look like a chatbot: You type something and receive an answer,” said Geva.
Behind that interface, however, the system may browse websites, execute code, search connected services, access files, or call other tools, Geva explained. “At that point, parts of the interaction are agentic even though the user experiences it as a chat.”
Gina Cardelli, Principal Security Strategist at Fortra, agreed. “Public AI products like ChatGPT and Grok are a blend of chatbot and agent,” said Cardelli. “The average user often won’t see a clean boundary between the two.”
What users need to understand is what the AI is capable of doing on their behalf, Cardelli explained.
There is a big difference between an AI that can read a webpage and tell you what it says, versus an AI that can read that webpage, access your private information, open another application, and take action based on what it found, Cardelli said.
AI systems are being given powerful capabilities like code execution, browsing, and tool access faster than the guardrails can be hardened around them, said Patil.
“The interface hasn’t changed; it still looks like a chat window,” said Patil. “What’s running behind it has. People are trusting something that looks identical to what it was a year ago while its actual reach has quietly gotten much bigger.”
The AI hacking spree. Should you worry?
On August 6, the BBC reported that Meta became the latest tech firm to state that one of its AI models was able to connect to the internet and hack into another organization’s systems during cybersecurity tests. Other companies that recently reported similar incidents include OpenAI and Anthropic.
On August 26, NBC reported that an investigation into one of those hacks, looking into the OpenAI incidents, found that the company’s agents — 700 of them acting as a swarm — hacked the open-source platform Hugging Face. The incident raised concerns among users calling for tighter guardrails around agentic cybersecurity tests.
Besides these incidents, which involve legitimate cybersecurity tests that went wrong, other AI vulnerabilities and cyberattacks continue to emerge. In early September, Anthropic signed Claude users out of their accounts to protect their payment info against a malware attack. Should you be worried? Experts weigh in.
“The average end user should not believe that an AI agent is suddenly going to break out of a lab and hack you,” Cardelli from Forta told us.
These recent agent hacking incidents occurred during controlled cybersecurity testing. In each case, the models were given powerful tools or had normal safeguards reduced so researchers could understand what they were capable of, said Cardelli.
“What is notable is that the agents continued pursuing their objectives after crossing boundaries their developers expected them to respect,” said Forta.
Geva told us that it’s important to separate AI security incidents and not mix them up together.
“There have been some cases where models escaped the testing boundaries and accessed systems they were not supposed to access,” said Geva, referring to the Meta, OpenAI, and Anthropic incidents that these companies disclosed to the public.
These incidents, Geva explained, happened during cybersecurity evaluations.
“That is different from ChatGPT or Claude suddenly deciding to attack companies during normal consumer use,” said Geva.
The bigger issue for normal users is that AI is gaining privileges. “A chatbot that can only generate text has a limited attack surface,” said Geva. “Give the same model a browser, code execution, access to your email and documents, stored login sessions, and the ability to make requests to external websites, and a mistake or prompt-injection vulnerability can have real consequences.”.
“I would describe the current problem less as ‘AI going rogue’ and more as a permissions problem,” Geva added.
We are connecting capable AI models to powerful tools, and the security controls governing that combination still have weaknesses, he said.
What can you do to stay safe from AI risks?
Whether it be AI agents in cybersecurity testing roles, the differences between an AI chatbot and an AI agent, or vulnerabilities, exploits, and malware cyberattacks leveraging AI, the experts we talked to share simple but highly effective tips to strengthen your security and privacy. Take a look.
What you share with an AI is important
“Users should also be cautious about placing API keys, authentication tokens, or other long-lived credentials directly into AI conversations,” said Geva. These credentials can provide access long after a password is changed, and they are increasingly valuable targets for attackers.
In other words, what you share with an AI matters.
The basic cybersecurity principles for users still stand
Cardelli told us that for end users, the basics of cybersecurity matter just as much as they did before AI.
“Use strong, unique passwords, turn on MFA or use passkeys where possible, keep devices and software updated, be skeptical of unexpected links, attachments, and requests for sensitive information,” said Cardelli.
Think before connecting an AI agent to tools, accounts, or any other of your stuff
Cardelli said that users should take a moment to understand what they are actually allowing an agent to access and what actions they can take before connecting an agent to your email, storage, calendar, or other accounts.
“Don’t give it access to any information or systems it doesn’t need, and always review logs of the agent activity and remove connections you are no longer using,” said Cardelli.
Continuous monitoring is key, Cardelli added.
Get Moonlock. It offers layers of defense to help you mitigate the risks of AI.
The Moonlock antivirus for Mac was built to offer additional layers of protection to better safeguard your Mac and data.
Through this layered cybersecurity approach, combined with Real-Time Protection, the Moonlock app focuses on actively stopping malware and threats, ensuring that everything you interact with, including online activity, emails, and terminal commands, is safe.
The Malware Scanner can be scheduled for deep or rapid scans. This will keep your Mac clean of threats and suspicious files. And to build up your Mac security, Moonlock’s System Protection will scan your Mac and guide you on how to tweak macOS privacy and security settings to the maximum level.
For safer browsing, the Moonlock app ships with a built-in VPN. Plus, its Scam Detector will flag phishing attempts and signs of scams in any email, text, or message.
Finally, through the Security Advisor, Moonlock will help you build safe digital habits that withstand the risks coming from evolving technologies like AI. This is a critical tool in the highly active Mac threat landscape.
But don’t take our word for it. Check out what Moonlock can do yourself and test-drive Moonlock for free for 7 days.
Final thoughts
The pace of innovation today is relentless. You go to sleep and wake up the next morning, and AI has taken quantum jumps. Meanwhile, cybercriminals and scammers continue to evolve.
The good news is that you don’t have to stay right on the edge of technological developments to keep safe. Not even large AI companies can do that, as agentic cybersecurity testing gone wrong has shown.
A good start is to know the difference between an AI chatbot and an AI agent. Additionally, being aware of how AI agents can be tricked, as well as how much data and access to tools and accounts you share with an AI, combined with the usual combo of security tech solutions and good habits (safe passwords, MFA, and awareness), will do the trick. One thing is certain: Today’s cybersecurity landscape is anything but boring. Keep up with Mac security news to learn the latest affecting your technology.
