Hackers can turn Grok, Copilot into covert command-and-control channels, researchers warn

Researchers have discovered that attackers can abuse web-based AI assistants like Grok and Microsoft Copilot to create command-and-control channels (hidden communication paths between malware and attackers), hiding malicious traffic within normal AI service traffic that organizations typically allow through their networks without inspection. This technique works because many companies grant unrestricted access to popular AI platforms by default, allowing malware to receive instructions through the AI assistants while remaining undetected.