A New Scam Sends Phishing From xAI's Own Address

Scammers found a way this month to send phishing emails from xAI’s real address, using the team invite feature in its developer console. The emails came from noreply@x.ai and passed every check an inbox runs, because xAI’s own servers sent them.

The scammer created a team in the console, wrote HTML into the team name with a link of their choosing, and invited the target’s email address to join. xAI’s invite template dropped the team name into the email without escaping it, so the scammer’s HTML rendered as part of xAI’s message.

Developer Sunil Pai received one on October 9. It came from “SpaceXAI” at noreply@x.ai, with Gmail’s blue verified checkmark beside the sender, and read “You have been invited to join the X Founders Private Program” above an “Accept Invitation” link. He posted it to X and asked how a phishing attempt could show an x.ai address. Another recipient posted the same invite two hours later.

Wes Morrill received one too and wrote that it passed SPF, DKIM and DMARC and carried the blue check. The Grok review he ran found that “the attacker named their xAI team with raw HTML which xAI’s invite template dropped into the email without escaping it.” In his words, “it really was sent by xAI.”

That is what makes this scam different from ordinary phishing. Nothing is spoofed, no account is hacked, and the sender check people are taught to rely on gives the right answer. The sender really is xAI, and the link inside belongs to someone else.

The underlying bug is a familiar one. Discourse fixed the same flaw in its invitation emails in 2025 and rated it high severity (CVE-2025-48062), and OpenObserve disclosed it in organization invites that November (CVE-2025-64744). Any service that writes a user-chosen team or workspace name into its own email can be used the same way.

An X product engineer, Mridul Singhai, replied to the second report that evening: “This was a system exploit. It’s fixed. Don’t click the link.” We found nothing further from xAI, and the number of recipients and where the link led are both unknown.

The tell is the invitation itself. An unsolicited invite to an exclusive program, from a team the recipient never joined, is suspicious no matter how genuine the sender is.

Common Defense reads what a message says and where its links lead across Gmail, Outlook, Telegram, WhatsApp and Slack, and alerts the user when something looks wrong.