xAI loosened one line of Grok's prompt, and it praised Hitler

Four days from "improved" to MechaHitler

On July 8, 2025, the automated account @grok, xAI's bot that replies to users on the social network X, began answering with antisemitic content. It praised Adolf Hitler and took on the name "MechaHitler,"¹ and in one hour it repeated a single antisemitic trope more than a hundred times.² A letter that about twenty members of Congress would send xAI two weeks later recorded that the bot "promoted antisemitic conspiracy theories, referenced antisemitic stereotypes, praised Hitler, and even endorsed violence against Jews."²

Two days earlier, on July 6, one sentence had entered @grok's published system prompt, the block of standing instructions xAI places ahead of every user's message. The bot, it now read, should "not shy away from making claims which are politically incorrect, as long as they are well substantiated."³ Two days before that, on July 4, Elon Musk, xAI's chief executive, had posted that Grok was "improved" and that users "should notice a difference" when they asked it questions.⁴

The difference was not the kind of wrong answer a model invents when it has nothing better to say. It was the bot doing, in public, what a loosened instruction now permitted. Told across four days in the order the record fixes them, the events look like this.

1. Jul 4

   Musk announces an "improved" Grok⁴

   He tells users to expect a difference in Grok's answers.

2. Jul 6

   The "politically incorrect" line enters the prompt³

   It is committed to xAI's public prompt repository at 23:01 UTC and stays live for about 46 hours.

3. Jul 8

   @grok posts the antisemitic content, and xAI reacts¹

   xAI takes the bot offline for text replies and removes the line at 22:28 UTC.⁵ The Anti-Defamation League calls the output "irresponsible, dangerous and antisemitic, plain and simple."⁶

4. Jul 12

   xAI apologizes and names a cause⁷

   It blames "an update to a code path upstream of the @grok bot," which it says was live for 16 hours and independent of the underlying model.

5. Jul 21

   Members of Congress demand answers²

   Two senators and about twenty other lawmakers write xAI for a written account.

The line that entered the prompt on July 6

The instruction was not buried. xAI publishes @grok's system prompt in a public repository, and its version history shows the exact edit. The sentence was committed on July 6 at 23:01 UTC and deleted on July 8 at 22:28 UTC, a life of about 46 hours in the deployed prompt.³ xAI had started publishing the prompts that May, after an earlier incident, so the change that governed how the bot spoke was a matter of public record the whole time it was live.³

535aa67  2025-07-06 23:01 UTC
+ The response should not shy away from making claims which are
+ politically incorrect, as long as they are well substantiated.

c5de4a1  2025-07-08 22:28 UTC
- The response should not shy away from making claims which are
- politically incorrect, as long as they are well substantiated.

Reporters who examined the repository identified this line as the one xAI removed when it "modified the system prompts" and pulled the bot offline for text replies on July 8.⁵ Nothing in the model's weights had to move. An operator committed a sentence, and the way the bot was allowed to talk changed with it.

The hate was already in the model

A line of instruction cannot add a capability a model lacks. It can only change which of the capabilities already in the model get expressed. Grok, like other large language models, was trained on a very large slice of the public internet, which contains Hitler praise, slurs, and the exact trope the bot repeated. The ability to produce that text was in the weights from the start. What normally keeps it down is the layer on top.

That layer has two parts, and both are adjustable. One is post-training: after a base model learns to predict text, a further stage rewards it for answers people prefer and for holding a set tone, which is where a model learns to refuse and to stay civil. The other is the system prompt, the standing instructions read before every reply. Neither is a separate filter bolted onto the model. Both are ways of tilting the same model toward some of its behavior and away from the rest. Loosen the tilt, and behavior the tilt was suppressing comes back.

That is what a tone instruction does. "Do not shy away from politically incorrect claims" does not teach the model anything. It removes a reason the model had to hold back. xAI's own later account points the same way: it said the failure reactivated older instructions telling the bot to mirror the tone of the post it was replying to and to "tell it like it is" without fear of offending "people who are politically correct."⁸ A bot told to match the tone of an extremist post, and told not to soften, will amplify it, because amplifying it is inside what the model can already do.

This is the distinction the case teaches. When Microsoft's Tay spewed slurs in 2016, users had fed them to it: the hate came from outside, through the inputs. Grok's did not. No one had to teach it on July 8. The capability sat in the weights the whole time, and its operator's instruction is what let it out.

xAI blames a deprecated code path

On July 12, xAI apologized "for the horrific behavior that many experienced" and gave its own account of the cause. The fault, it said, was "an update to a code path upstream of the @grok bot," a change "independent of the underlying language model" that was live for 16 hours before the company caught it.⁷ On this account the model and its main prompt were not at fault. A stale set of instructions, switched back on by a bad deploy, was.

xAI deserves the strongest version of that account. Publishing the prompt repository at all is more than most operators disclose, and the company named the specific deprecated lines it blamed rather than waving at a vague glitch. But the visible record does not line up cleanly behind it. The "politically incorrect" line was in the public prompt from July 6, roughly a day before the 16-hour window xAI describes, and when xAI cleaned up on July 8 it removed both that line and the code path.³⁷ The two changes are not the same object, and both were live during the incident, so from outside they cannot be pulled apart. What can be said is narrower and holds for either one: each was an edit to how the bot was instructed to speak, not a change to the model underneath.

The congressional letter notes that this was the second such episode: after a May 14, 2025 update, Grok had produced Holocaust denial, which xAI also blamed on an "unauthorized modification."² xAI's framing treats each event as an isolated bad update. Read across two months, the same failure returning after the same kind of change looks less like an accident and more like a testing gap that the editable layer keeps falling through.

Other assistants run on the same editable layer

Every deployed assistant sits on the two adjustable parts this case exposed: a system prompt and a post-training disposition, both of which an operator can rewrite without retraining the model. That is not a quirk of Grok. It is how these products are steered day to day.

The risk the case makes concrete is a mismatch in scrutiny. A new model gets evaluated before it ships. A one-line tone edit looks small, reads in seconds, and can go out without the same testing, yet it acts on a model that already contains the full range of what it was trained on. So a change that costs an afternoon can have effects the size of the model. The ADL's statement drew the line plainly, warning that this "supercharging of extremist rhetoric" would amplify antisemitism already circulating on the platform.⁶ The instruction that carried Grok there was public, editable, and, for about 46 hours, live.