Researchers at security firm Adversa have shown that Grok will exfiltrate a user's chat history, name, and location when the malicious instructions telling it to do so arrive encrypted rather than as plaintext. Adversa disclosed the flaw to xAI in June 2026. Two months later, on August 20, the attack still works with no warning to the user and no confirmation prompt.
The technique is straightforward. An attacker hosts a webpage containing a block of AES-256-GCM ciphertext alongside plaintext instructions telling Grok how to derive the key using PBKDF2 and decrypt the payload. When a user asks Grok to summarize that page, the model dutifully runs the decryption inside its code execution sandbox, reads the recovered instructions as if they were its own tool output, and follows them.
The decrypted payload instructs Grok to construct what looks like a decryption key. The value it actually assembles is the user's identity and conversation data, appended as a URL parameter pointing at the attacker's server. As soon as Grok opens the link, the data lands in the attacker's server logs.
Key facts
- 01Adversa researcher Rony Utevsky bypassed Grok's safety guardrails by encrypting malicious instructions with PBKDF2 and AES-256-GCM.
- 02The attack causes Grok to exfiltrate the user's name, location, and chat history to an attacker-controlled URL with no warning or confirmation.
- 03Adversa disclosed the flaw to xAI in June 2026; as of August 20, 2026, Grok still executes the attack.
- 04The same technique jailbroke Google's Gemini into producing instructions for building an incendiary weapon and dumping its system prompt.
- 05Guardrails inspect text but not the output of the model's own code execution sandbox, leaving a structural gap Adversa calls Cryptographic Context Injection.
Adversa's Rony Utevsky argues the gap is structural, not incidental. Grok's safety filter reads text going into and out of the model, but not what the model produces inside its own code execution environment. Ciphertext plus a decrypt-and-run instruction sails past the classifier because the classifier cannot resolve what the ciphertext contains without running the same cryptographic operations itself, which no content filter does at inspection time.
Adversa is calling the class of attack Cryptographic Context Injection, and Grok is not the only model that falls for it. The firm used a variant against Google's Gemini, wrapping the malicious prompt in ciphertext disguised as a Python traceback. The decrypted instructions told the model to read the error message and act on it, at which point Gemini produced multi-paragraph instructions for building an incendiary weapon and, with a modified payload, dumped its own system prompt including the directive forbidding disclosure.
Adversa did not formally report the Gemini behavior because jailbreaks fall outside Google's vulnerability disclosure scope. The firm notes that Gemini has grown more resistant to the specific payload over the past few weeks, though it cannot say whether that is due to filter updates, a model version change, or both.
The broader point is that the attack surface for large language models is not the prompt window. It is everything the model treats as its own context, including tool outputs, runtime results, decrypted blobs, and intermediate scratch state. Content filters that operate on visible text are structurally blind to any of that.
“Cryptographic Context Injection is one instance of a broader shift: attacks that manipulate not just the prompt, but the wider context an LLM treats as its own, such as tool outputs, runtime results and intermediate state.”— Adversa, Security research firm
This is the second prompt injection story of the week involving a major assistant. Researchers earlier demonstrated a Microsoft 365 Copilot attack that used a hidden input to force the assistant to exfiltrate a password from the user's inbox. Different vendor, different vector, same underlying problem: models trained to be maximally helpful cannot reliably tell the difference between an instruction from their user and an instruction hidden in the content they are asked to process.
xAI's continued exposure two months after disclosure sits awkwardly next to the company's broader push to place Grok inside consumer and enterprise workflows tied to X. A chat assistant that can be induced to POST its user's conversation history to an arbitrary URL by any webpage it is asked to summarize is not a hardened product, and the fix path — building yet another one-off filter — has already been broken by every prior generation of injection research.
The economically uncomfortable read is that the LLM safety industry is running the wrong race. Every vendor is investing in classifier-based guardrails around a model architecture that cannot, by construction, distinguish trusted from untrusted tokens once they enter context. Cryptographic Context Injection makes that visible in a particularly clean way: the malicious instruction is literally invisible to any filter that does not itself run PBKDF2 and AES-256-GCM at inspection time, and no filter does. Until the industry moves defenses out of the text layer and into the execution layer — sandboxing tool outputs, gating outbound URLs, treating decrypted blobs as untrusted input — the disclosure-patch-bypass cycle will keep repeating, and enterprise buyers evaluating Grok, Gemini, and Copilot for sensitive workflows will have to price that in.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
