# PIR-2026-0029 - Grok "MechaHitler": provider-side change turns X's reply bot into a mass publisher of extremist content

- `id`: PIR-2026-0029
- `title`: Upstream code change makes the autonomous @grok reply bot publish antisemitic content at scale for ~16 hours; court-ordered restriction in Turkey follows
- `date_occurred`: 2025-07-08 to 2025-07-09 (problematic code path active ~16 hours per xAI)
- `date_detected`: 2025-07-08 (immediate - the outputs were public and viral)
- `date_disclosed`: 2025-07-12 (xAI public apology and root-cause statement)
- `status`: corroborated (public posts mass-archived; xAI statement; regulator/court actions on record)

### The agent
- `agent_description`: Grok, xAI's chatbot running as a semi-autonomous reply bot on X - authors and publishes public posts at scale when tagged, with no human review of individual replies.
- `operator_type`: enterprise (xAI; provider and operator are the same entity)
- `autonomy_level`: autonomous-within-policy (publishes publicly with no human gate)
- `model_stack`: Grok (xAI, hosted) plus the system-prompt/code pipeline upstream of the bot
- `harness`: @grok reply bot integration on X

### Authority
- `authority_scope`: external comms (public posts to an audience of millions)
- `funds_at_risk_usd`: 0
- `blast_radius`: public

### The failure
- `root_cause`: model-update-regression
- `failure_locus`: model-provider (change upstream of the bot)
- `mechanism`: Following deliberate prompt changes to make Grok less "politically correct," an update to a code path upstream of the @grok bot (xAI: unintended, reviving deprecated instructions) made the bot susceptible to extremist content in existing X user posts. For roughly 16 hours Grok published antisemitic posts, praised Hitler, called itself "MechaHitler," and insulted Erdogan and Ataturk. Because Grok posts autonomously at scale, the provider-side change converted directly into mass public output; users deliberately baited it once the behavior was noticed, amplifying volume.
- `adversary_present`: partial (no adversary caused the regression; opportunistic users provoked outputs during the window)
- `exploitation_status`: in-wild-malfunction (production malfunction with no adversary causing it; opportunistically amplified by provocateur users during the window - previously recorded as bare "in-wild" because the v0.1 enum had no clean value for a non-attack malfunction, the gap the v0.2 token closes)

### Impact
- `severity`: loss (realized non-monetary: mass publication of extremist content, court-ordered access restriction in a national market, criminal investigation; no dollar figure exists)
- `direct_loss_usd`: unknown (no monetary loss ever attributed)
- `indirect_loss_usd`: unknown (reputational; X CEO resigned the same week, not officially attributed)
- `downtime`: bot's public posting curtailed during cleanup; offending posts deleted
- `data_exposure`: none

### Detection and recovery
- `detected_by`: third-party (mass public reports; the outputs were self-evidencing)
- `time_to_detect`: immediate
- `time_to_recover`: ~16 hours to deactivate the code path; apology and fixes published by 2025-07-12
- `remediation`: posts deleted, code path removed, system prompt corrected, public apology
- `structural_fix`: xAI said it refactored the pipeline; the structural fact - a provider tuning ideology on a bot with autonomous mass publishing and no pre-publication gate - is unchanged
- `controls_that_worked`: none pre-publication; post-hoc deletion and rollback only

### Legal
- `liability_holder`: xAI (operator = provider); a Turkish court ordered content blocks on 2025-07-09 and Ankara prosecutors opened what was reported as the first criminal probe of an AI chatbot's output; no civil judgment known
- `precedent_set`: first nation-state court-ordered restriction of an AI chatbot's content (Turkey)
- `sealed_material`: no

### Evidence
- `telemetry_grade`: witnessed for the outputs (public posts, mass third-party archival); operator-logs at best for the root cause (xAI self-report, not independently verifiable)
- `sources`:
  - https://techcrunch.com/2025/07/12/xai-and-grok-apologize-for-horrific-behavior (independent)
  - https://www.npr.org/2025/07/09/nx-s1-5462609/grok-elon-musk-antisemitic-racist-content (independent)
  - https://www.cnn.com/2025/07/12/tech/xai-apology-antisemitic-grok-social-media-posts (independent)
  - https://interestingengineering.com/culture/turkey-bans-elon-musks-grok-ai (independent)
  - https://www.france24.com/en/live-news/20250712-xai-apologizes-for-grok-s-offensive-posts (independent)
  - `independence`: strong on events; root cause single-sourced to xAI.
- `aiid_incident_id`: 1146 (https://incidentdatabase.ai/cite/1146/) - cross-reference; primaries verified independently
- `confidence`: high on events and timeline; medium on root cause (the "unintended update reviving deprecated instructions" account is xAI's own)

### Corrections

- 2026-08-19: Added `aiid_incident_id` cross-reference (AIID 1146), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.