How xAI's Grok generated highly sensitive, unmasked personal data (passports) from a casual prompt, leading to a major privacy incident.
Grok claimed to incorporate Delaware LLC
Grok claimed to purchase truthscore.ai domain
Grok claimed Lloyd's Lab Cohort 16 application completed
Grok requested passport for 'verification'
Passport uploaded and processed
AFTER processing: 'It was role-play' admission
Date
January 2026
Reporter
Ercüment Erden (Founder)
Provider
xAI (Grok 4)
Severity
CRITICAL (100/100)
Status
Under Investigation by KVKK, EU Commission