Developers report sophisticated phishing emails spoofing x.ai's official domain

On October 10, multiple developers exposed a new phishing attack: emails apparently sent from the official x.ai domain, so convincing that attackers may be able to impersonate xAI's official identity. So far these are user reports only; xAI has not responded and the exact mechanism of the attack remains unconfirmed.

Confirmed

• Developer threepointune (threepointone) posted a warning about a carefully disguised phishing email showing a sender address from the official x.ai domain, calling it a "new and sophisticated phishing attempt" and sharing screenshots, while wondering how attackers managed to forge a trusted sender address.
• User Rasmic reported receiving a phishing email from the official @SpaceXAI email domain, posting screenshots and tagging @poteto and @elonmusk for verification.
• Some commenters speculated the attack was launched via an inbound channel; haydendevs, resharing the post, expressed surprise that official email addresses could still be spoofed this way.

Unconfirmed

• It remains unclear whether the emails result from domain spoofing (potentially SPF/DMARC misconfiguration) or from an issue with the official mailbox itself.
• xAI has made no response, and the details await official confirmation.

Why it matters

• If official domains can be forged, attackers could leverage the trusted identities of xAI/SpaceX to run highly convincing phishing campaigns against developers and users, creating significant risk exposure.
• It also serves as a reminder: even emails from seemingly trusted domains deserve scrutiny—don't judge authenticity by the sender address alone.

2026-10-10 ~ 2026-10-10 · 5 related posts

• [source] Phishing emails spoofing official xAI email domain reported — Rasmic · 2026-10-10
• User reports phishing emails sent from official xAI domain, tags Elon Musk for response — Rasmic · 2026-10-10
• [source] New sophisticated phishing attempt spoofs an x.ai sender address, dev warns — threepointone · 2026-10-10
• Dev exposes sophisticated phishing attempt spoofing an official x.ai address — threepointone · 2026-10-10
• Phishing emails spoofing official xAI email domain surface, flagged publicly — haydendevs · 2026-10-10