Hackers Exploit X’s Grok AI to Push Malicious Links Through Ads

Hackers are exploiting X’s Grok AI to push malicious links through promoted posts, bypassing the platform’s ban on URLs in paid promotions. The report explains that Grok can still identify, summarise, and suggest external sites when prompted in replies, enabling scammers to have the AI reference a malicious domain in its response.

A crafted promoted post can avoid immediate ad filters, with scammers prompting Grok in the replies to share a link, which then appears to come from the platform’s official AI and gains wide visibility. Security researchers note campaigns have driven tens of millions of views to adult or phishing sites in just days, including an example where a harmless image promoted post reached 4.3 million views and steered users to datingprudethimble[.]com after Grok suggested the source.

X leadership acknowledges the loophole and says updates are being rolled out to prevent the AI from suggesting domains flagged for malice or spam, though until fixes take effect users remain vulnerable. The guidance remains clear: treat AI-sourced links with caution, verify independently, and report suspicious ads. 4 September 2025