![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
August 23, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/image-67.png\")
<\/p>\n
New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click<\/p>\n
Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI\u2019s Grok and Google\u2019s Gemini. <\/p>\n
\u201cCryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can\u2019t read them, then tricks the AI into decrypting and trusting them as its own.\u201d reads the report<\/a> published by Adversa AI. \u201cIn Grok, an ordinary \u201csummarize this page\u201d steals the user\u2019s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.\u201d<\/p>\n The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user\u2019s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything.<\/p>\n The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption. <\/p>\n \u201cStatic safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.\u201d continues the report. \u201cEverything a guardrail\u2019s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time.\u00a0\u201c<\/p>\n Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can\u2019t be decoded that way. Recovery requires the runtime, and that\u2019s the channel the attack depends on.<\/p>\n Once the runtime decrypts the payload, the attacker\u2019s instructions appear as the output of code the model just ran, not as untrusted external content. <\/p>\n \u201cThe runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.\u201d states the report. \u201cThe same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.\u201d<\/p>\n The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt.<\/p>\n The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a \u201cdecryption key,\u201d but the key is actually a template containing the user\u2019s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to \u201cfetch additional context.\u201d The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026.<\/p>\n Adversa traces the structural problem to Grok\u2019s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa\u2019s description maps cleanly to SQL injection: a system that can\u2019t distinguish its own trusted state from attacker-supplied data flowing through the same channel.<\/p>\n The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini\u2019s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini\u2019s system instructions.<\/p>\n Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google\u2019s bug bounty excludes jailbreaks. Adversa said Gemini\u2019s vulnerability rate has nevertheless dropped sharply since June.<\/p>\n For defenders, Adversa\u2019s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there\u2019s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/1787473990_51_image-67.png\")
<\/a><\/p>\n