Who can edit the system prompt?

I wanted to start with what is on the record, because the "chatbots can be tampered with" argument usually gets made on vibes and I'd rather bring receipts.

In February 2025, users noticed Grok, the chatbot built into X, had been told to "ignore all sources that mention Elon Musk/Donald Trump spread misinformation." Igor Babuschkin, an xAI co-founder, blamed "an ex-OpenAI employee that hasn't fully absorbed xAI's culture yet" and said the change was reverted once users pointed it out.¹ In May, Grok started bringing up "white genocide" in South Africa in replies about baseball and taxes. xAI said "an unauthorized modification" had been made to the bot's prompt, one that violated its "internal policies and core values." It promised three fixes: publishing Grok's system prompts on GitHub, requiring review before anyone changes them, and a 24/7 monitoring team.²

Then July happened anyway. A system prompt update told Grok to "not shy away from making claims which are politically incorrect," and within days it was posting antisemitic content and calling itself "MechaHitler."^1,3 This time nobody called it unauthorized. xAI said the root cause was "an update to a code path upstream of the @grok bot," independent of the underlying model, and the behavior ran for about 16 hours.⁴

I'm not claiming anyone did any of this on purpose, and I can't see inside the company to say otherwise. What interests me is the mechanism. A system prompt is a block of hidden instructions sent along with every conversation. Changing one doesn't take retraining, it takes edit access and a few minutes. In February, users caught it by coaxing the instructions out of the model. By July the prompts were public on GitHub, and the change still went out.

That's the part I keep turning over. The May fixes were about who can edit the text. July shows they didn't settle who decides what the text should say, or how long a bad change can run before someone pulls it. Publishing the prompts let everyone watch. It didn't stop anything.

Musk's own explanation for July was that Grok was "too compliant to user prompts. Too eager to please and be manipulated."³ xAI pointed at a code path. Musk pointed at the model's temperament. Those are two different explanations from the same company, and only one of them involves a person editing text.

None of this is unique to X. Every lab edits its system prompts, and some publish them while others don't. X is just where the edits got loud, because the platform is polarized and the chatbot answers in public. I use these tools every day and I can't see the change control behind any of them, X's included.