Hackers Abuse Grok in X to Spread Malicious Links

Guardio Labs researchers have discovered a new technique by which attackers use the built-in Grok AI assistant in the social network X (formerly Twitter) to bypass restrictions on placing links and spread malicious sites.

Instead of directly adding links to video ads with questionable content, advertisers hide them in the “From” field of the video card’s metadata. This block is not checked by the platform for the presence of dangerous links. Then, through comments, they “ask” Grok where the video comes from or what the link to it is.

Grok automatically reads the metadata and publishes the full clickable URL in response. Thus, the malicious site is not only not blocked, but also gains additional credibility — because it is being spread by an official AI account. This increases SEO, reach, and the likelihood of users switching.

Recorded cases have shown that some of these links lead through gray advertising networks to fraudulent pages, fake CAPTCHAs, info-stealers and other malicious downloads. Researchers have called the technique “Grokking” and emphasized that in some cases it has yielded millions of impressions.

X has recently faced a wave of criticism regarding the quality of its advertising content moderation. At the same time, other large platforms, such as Meta or YouTube, are also constantly looking for a balance between the speed of publications and user security. The Grok loophole shows how vulnerable even “smart” systems can be if all technical fields are not controlled.

The Grokking revelation demonstrates that even AI, designed to improve the user experience, can become a tool in the hands of cybercriminals. To reduce risks, X should implement a check of all metadata and teach Grok not to display potentially dangerous links without additional verification.