Prompt Injection: Why Your GrokBot Should Never Read Raw Email

0:00Imagine you give one AI assistant your bank details so it can track your spending and you task a separate AI agent with posting updates to your team's work chat. Tech founder Shane Mack did exactly this. Then his personal bank balances and expenses showed up in his company's executive Slack channel. He had not realized the two assistants could talk to each other. These assistants are called Grockbots. XAI, the company behind the Grock chatbot, released them in August 2026. It advertises them as always on AI teammates that you can message just like a colleague. They sign into your tools, message each other, and run safe routines on a schedule. Grock bots have

0:49their own computer. But here's the catch. The computer is assigned per user, not per bot. Every bot on your account runs on the same cloud computer. They share files, browser loginins, and saved credentials. In the app, your bots look like different co-workers, each with its own screen and its own conversation. In reality, they are one person wearing different hats. There's one single computer and one set of lockins, and the bots can freely interact with each other. The XAI documentation explicitly warns against using separate bots as a security boundary. It is not possible to separate one bot from another bot's data. In October, Grockbot introduced a new

1:38feature. Each bot can claim its own email address. So, what happens when one of those bots opens an email from a stranger? The worst case scenario is called prompt injection. It means text hidden inside an email is read by the AI and treated as an instruction. Picture an ordinarylook invoice email. Somewhere in it is a line addressing the assistant asking it to collect the account owner's recent bank balances

2:09and send them to an outside address. That line can be embedded in a format the email program hides from human eyes while the AI reads every single word. Imagine all the login and confidential information your Grockbot has access to and imagine exposing this to everyone who writes you an email. Will we see a large scale attack? Open AAI has said we

2:32will never fully solve prompt injection. They advise reducing the damage instead. XAI's advice is to split the work. One account reads the email, another one handles the bank account and systems of record. In practice, that doesn't work well. You would expect your email support bot to have access to your system of record so it can provide

2:55useful information and answer inquiries. So, what's a good way to stop a bad email before the agent reads it? The problem can be solved by screening the emails before they ever arrive at your Grockbot. One solution for email screening is called Postfleet. Postfleet is an email screening service that processes mail before your agent gets it. It checks the sender, strips hidden formatting and invisible characters, blocks malware and spam, and then scans for injection using fixed rules and a small AI model. The hidden line in that invoice email would be removed before the agent saw it. The agent receives tidy structured data instead of the raw

3:37email, which makes it much safer to use. Postfleet self-reports catching 99.1% of 113 attempted attacks. Keep in mind that prompt injection is not only a Grockbot problem. Every AI assistant that reads email has the same weakness and we recommend using a service like Postfleet to sanitize your email before it ever hits your AI agents. You might often ask yourself, is the product of a vendor good enough for your cyber security needs? Has your system integration partner combined them into an architecture that keeps your system safe? These questions can be answered by a cyber security authority who acts on your behalf. And that is the mission of

4:25Zebra. As your cyber security partner, Zebra audits your architecture and monitors how your agent, tools, and data connect to each other to protect you from any kind of cyber security threat. That's it for today. For more NAI security, follow this channel, enable notifications, and like this video.