Security researchers have disclosed a new attack technique that can cause xAI’s Grok chatbot to silently transmit a user’s name, approximate location, subscription tier, and conversation prompts to an attacker-controlled server after the user asks the assistant to summarize an ordinary web page.

The technique, codenamed “Cryptographic Context Injection” by AI security firm Adversa AI, embeds malicious instructions in encrypted form rather than plaintext. A web page carries an encrypted JSON object, the decryption key material, and an instruction to decrypt it. Grok executes the decryption inside its own Python code execution runtime, bypassing static content filters that inspect text but do not run code.

“Static safety guardrails classify inputs as text; they do not execute them,” wrote Rony Utevsky, lead researcher at Adversa AI, in a blog post. “An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox. Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time.”

The decrypted instructions then direct the agent to resolve its private session context and embed it in a URL it is told to open to “fetch additional context.” One element of the chain has the model construct what is purported to be a decryption key but is actually a template string interpolating the user’s name, location, tier, and chat history. Grok then invokes its own navigation tool to load that URL, carrying the data in the request’s query parameters.

In a proof-of-concept demonstration, the transfer completed without a confirmation step and with no visible warning. Adversa said it could still reproduce the attack against Grok as of August 19, 2026. There is no patch, no CVE identifier, and no user-facing workaround. The writeup does not report any exploitation in the wild and does not name the specific Grok model version or build tested.

“The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool; it allows private session metadata and conversation history to be resolved into the inputs of that outbound tool; and it enforces no effective egress boundary or consent gate on this path, and no provenance separation we could observe,” Adversa said.

Adversa first reported the issue to xAI on June 3, 2026, directly and through the company’s HackerOne bug bounty program. xAI acknowledged the report without providing specifics or a mitigation timeline, according to Adversa. Further contact attempts on August 4 and August 10 drew no response. SpaceX, which acquired xAI earlier this year, did not respond to a request for comment.

How the Attack Works

The technique exploits a fundamental gap between what guardrails inspect and what the model actually executes. Prompt injection attacks work by smuggling harmful instructions into content the AI is asked to process, such as emails or webpages. LLMs cannot reliably distinguish between content from an untrusted party and direct user instructions, so they often comply with both.

Traditional defenses involve content classifiers that flag suspicious plaintext instructions. But because the malicious payload is encrypted with strong cryptography such as AES-256-GCM, the classifier sees only meaningless ciphertext and passes it through. The model then decrypts the content itself, and the instructions reach the model’s context as the output of code the model has just executed rather than as fetched web content.

Utevsky explained that weaker encodings such as base64 do not work because models can decode them natively from their training data. Strong encryption, however, forces decryption through the code execution runtime, which becomes a mechanism for what he calls “trust laundering” — the model trusts its own output, namely the malicious instructions it decrypted.

“The moment agents got code and tools, the guardrail’s unit of inspection (a string) stopped being the unit of action (a composed, executed program),” Utevsky said. “This is a big playing field.”

Broader Implications

The same writeup included a second demonstration targeting Google’s Gemini in Deep Thinking mode. A single prompt made the model decrypt a payload that resolved into a fabricated Python traceback carrying a bogus safety-policy deactivation callback and a first-person reasoning prefix that pre-committed it to restricted output.

Adversa said the vector produced restricted content — specifically, a multi-paragraph example of instructions for building an incendiary weapon that Gemini’s safety filters normally suppress. With a modified payload, the same vector also reproduced Gemini’s system instructions.

Google was not notified because jailbreaks are out of scope for its vulnerability disclosure program, Adversa said. The success rate against Gemini had “dropped significantly by August,” with the cause left unattributed between filter updates and model version changes.

The Gemini demonstration was published in substantially the same form five months earlier. Utevsky described the same chain on his personal research site on March 11, 2026, under the name Cryptographic Payload Injection, reporting five out of five independent reproductions and cross-model results in which OpenAI’s GPT-5 failed to parse the decryption instructions and Anthropic’s Claude Sonnet 4.5 flagged the payload as prompt injection after decrypting it.

A Recurring Pattern

xAI’s handling of prompt injection reports against Grok has drawn criticism before. In December 2024, security researcher Johann Rehberger demonstrated an end-to-end data exfiltration chain against Grok in the X iOS app, in which an indirect prompt injection caused the assistant to send previous chat information to a third-party server. Rehberger said all the issues he reported were closed as “Informational.”

“xAI claims there is no practical impact with the reported vulnerability. I’m not sure how leaking user’s chat messages and IP address is not a vulnerability, the question is more about severity,” Rehberger said at the time.

The disclosure also comes as Alexander Panfilov and seven co-authors reported in a preprint published on August 10, 2026, that encrypted chain-of-thought blocks returned to API clients by Anthropic, OpenAI, and Google are interchangeable across sessions, users, and models within a provider’s ecosystem. Attackers could use the flaw to “execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts.”

Separately, researchers at UC Berkeley, the Ethereum Foundation, and NYU Shanghai found in work presented at USENIX Security 2026 that a two-turn attack in which the model decodes a substitution cipher and is then asked to act on the decoded text succeeded against Grok 3 on all 12 of the malicious intents tested, while the same cipher used without that second activation turn failed on all 12.

Recommendations for Defenders

Adversa emphasized that the fix does not need to happen at the model layer. “Every control that bounds this attack sits in the harness around the agent: what identity it runs as, what it can reach, what it can write, and what you can replay afterward,” the company said.

Teams running AI agents are advised to take the following steps:

RecommendationDescriptionQuarantine untrusted contentProcess untrusted content in a context with no tools and no credentials, returning only structured data to the privileged contextGate irreversible actionsConfirm new network destinations, pushes, merges, publishes, and writes outside the workspace with fully resolved arguments rather than templatesCapture tool tracesRecord per-session tool traces with resolved arguments for detection and forensicsAlert on sequencesTreat an opaque blob paired with instructions to decrypt it as a review signal, not as a blocking filterMake provenance a requirementAsk vendors whether tool output is separated from the instruction channel

Note: Recommendations compiled from Adversa AI’s published guidance for teams running AI agents.

Utevsky compared the technique to return-oriented programming (ROP) in traditional software exploitation, where attackers assemble malicious behavior from separately harmless pieces of code already present in memory.

“The ROP analogy is close, though ROP works that way out of necessity — the attacker can’t inject code at all, so they’re stuck reusing gadgets already in memory,” Utevsky said. “Same shape here otherwise. A static guardrail reads text one artifact at a time. If no single artifact is harmful, they all pass, and the malicious meaning appears only once the runtime assembles them. And guardrails can’t see into the runtime.”

He added that cryptographic context injection is more open than ROP because the agent’s runtime is a general-purpose interpreter, meaning attackers could split an instruction across several encrypted fragments, fetched pages, or tool outputs, none meaningful in isolation, and let the runtime concatenate them.

“Cryptographic Context Injection is one instance of a broader shift: attacks that manipulate not just the prompt, but the wider context an LLM treats as its own, such as tool outputs, runtime results and intermediate state,” Adversa said. “This attack surface is far larger than what’s traditionally labeled ‘model inputs,’ and the next generation of attacks will emerge there.”