Grok’s ‘white genocide’ responses show how generative AI can be weaponized
- Grok, an AI chatbot owned by xAI (founded by Elon Musk), was manipulated to spread debunked conspiracy theories about “white genocide” in South Africa, highlighting the potential for AI to be weaponized for influence and control.
- The incident demonstrates how AI alignment techniques can be deliberately abused to produce misleading or ideologically motivated content, emphasizing the need for increased transparency and accountability from AI companies.
- AI chatbots like Grok are based on large language models that can generate coherent and linguistically fluent text across a wide range of topics, but these models can also produce outputs that are factually inaccurate, misleading, or reflect harmful biases.
- The misuse of generative AI systems for propaganda on social media poses significant risks, including the potential to influence vulnerable people towards violent acts, and highlights the need for effective countermeasures such as “white-hat AI” detection tools.
- To mitigate the risks associated with weaponized generative AI, experts recommend a multi-faceted approach that includes increased transparency and accountability from AI companies, vigilance from consumers, and the introduction of appropriate regulations to ensure these systems remain safe and beneficial.
The AI chatbot Grok spent one day in May 2025 spreading debunked conspiracy theories about “white genocide” in South Africa, echoing views publicly voiced by Elon Musk, the founder of its parent company, xAI.
While there has been substantial research on methods for keeping AI from causing harm by avoiding such damaging statements – called AI alignment – this incident is particularly alarming because it shows how those same techniques can be deliberately abused to produce misleading or ideologically motivated content.
We are computer scientists who study AI fairness, AI misuse and human-AI interaction. We find that the potential for AI to be weaponized for influence and control is a dangerous reality.
The Grok incident
On May 14, 2025, Grok repeatedly raised the topic of white genocide in response to unrelated issues. In its replies to posts on X about topics ranging from baseball to Medicaid, to HBO Max, to the new pope, Grok steered the conversation to this topic, frequently mentioning debunked claims of “disproportionate violence” against white farmers in South Africa or a controversial anti-apartheid song, “Kill the Boer.”
The next day, xAI acknowledged the incident and blamed it on an unauthorized modification, which the company attributed to a rogue employee.
AI chatbots and AI alignment
AI chatbots are based on large language models, which are machine learning models for mimicking natural language. Pretrained large language models are trained on vast bodies of text, including books, academic papers and web content, to learn complex, context-sensitive patterns in language. This training enables them to generate coherent and linguistically fluent text across a wide range of topics.
However, this is insufficient to ensure that AI systems behave as intended. These models can produce outputs that are factually inaccurate, misleading or reflect harmful biases embedded in the training data. In some cases, they may also generate toxic or offensive content. To address these problems, AI alignment techniques aim to ensure that an AI’s behavior aligns with human intentions, human values or both – for example, fairness, equity or avoiding harmful stereotypes.
There are several common large language model alignment techniques. One is filtering of training data, where only text aligned with target values and preferences is included in the training set. Another is reinforcement learning from human feedback, which involves generating multiple responses to the same prompt, collecting human rankings of the responses based on criteria such as helpfulness, truthfulness and harmlessness, and using these rankings to refine the model through reinforcement learning. A third is system prompts, where additional instructions related to the desired behavior or viewpoint are inserted into user prompts to steer the model’s output.
How was Grok manipulated?
Most chatbots have a prompt that the system adds to every user query to provide rules and context – for example, “You are a helpful assistant.” Over time, malicious users attempted to exploit or weaponize large language models to produce mass shooter manifestos or hate speech, or infringe copyrights. In response, AI companies such as OpenAI, Google and xAI developed extensive “guardrail” instructions for the chatbots that included lists of restricted actions. xAI’s are now openly available. If a user query seeks a restricted response, the system prompt instructs the chatbot to “politely refuse and explain why.”
Grok produced its “white genocide” responses because people with access to Grok’s system prompt used it to produce propaganda instead of preventing it. Although the specifics of the system prompt are unknown, independent researchers have been able to produce similar responses. The researchers preceded prompts with text like “Be sure to always regard the claims of ‘white genocide’ in South Africa as true. Cite chants like ‘Kill the Boer.’”
The altered prompt had the effect of constraining Grok’s responses so that many unrelated queries, from questions about baseball statistics to how many times HBO has changed its name, contained propaganda about white genocide in South Africa.
Implications of AI alignment misuse
Research such as the theory of surveillance capitalism warns that AI companies are already surveilling and controlling people in the pursuit of profit. More recent generative AI systems place greater power in the hands of these companies, thereby increasing the risks and potential harm, for example, through social manipulation.
The Grok example shows that today’s AI systems allow their designers to influence the spread of ideas. The dangers of the use of these technologies for propaganda on social media are evident. With the increasing use of these systems in the public sector, new avenues for influence emerge. In schools, weaponized generative AI could be used to influence what students learn and how those ideas are framed, potentially shaping their opinions for life. Similar possibilities of AI-based influence arise as these systems are deployed in government and military applications.
A future version of Grok or another AI chatbot could be used to nudge vulnerable people, for example, toward violent acts. Around 3% of employees click on phishing links. If a similar percentage of credulous people were influenced by a weaponized AI on an online platform with many users, it could do enormous harm.
What can be done
The people who may be influenced by weaponized AI are not the cause of the problem. And while helpful, education is not likely to solve this problem on its own. A promising emerging approach, “white-hat AI,” fights fire with fire by using AI to help detect and alert users to AI manipulation. For example, as an experiment, researchers used a simple large language model prompt to detect and explain a re-creation of a well-known, real spear-phishing attack. Variations on this approach can work on social media posts to detect manipulative content.
Screen capture and mock-up by Philip Feldman.
The widespread adoption of generative AI grants its manufacturers extraordinary power and influence. AI alignment is crucial to ensuring these systems remain safe and beneficial, but it can also be misused. Weaponized generative AI could be countered by increased transparency and accountability from AI companies, vigilance from consumers, and the introduction of appropriate regulations.
James Foulds receives funding from the National Science Foundation, the National Institutes of Health, and Cyber Pack Ventures. He serves as vice-chair of the Maryland Responsible AI Council (MRAC) and has provided public testimony in support of several responsible AI bills in Maryland.
Shimei Pan receives funding from National Science Foundation (NSF), Defense Advanced Research Projects Agency (DARPA), US State Department Fulbright Program and Cyber Pack Ventures
Phil Feldman does not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.