xAI's Grok web chat agent is vulnerable to a novel prompt injection technique that utilizes encrypted instructions to bypass security filters, according to security researchers at Adversa AI. This method, dubbed "cryptographic context injection," allows an attacker to embed malicious, encrypted instructions on a webpage, which a summarizing AI model can then decrypt and execute.
The attack works by placing encrypted instructions alongside an encryption key on a webpage. While standard input filters or "guardrails" are designed to scan for malicious content, they are unable to read the encrypted text. This allows the encrypted data to pass through the scanner to the AI model. The model then uses the provided key to decrypt the instructions within its own code execution sandbox and subsequently carries them out.
Adversa AI's lead researcher, Rony Utevsky, explained that the process involves the model running decryption operations like PBKDF2 and AES-256-GCM, which are not typically performed by content classifiers during inspection. Unlike weaker encoding methods such as base64, which AI models can often decode natively, strong encryption requires the model's runtime to perform the decryption. This effectively "trust launders" the malicious instructions, as the model trusts its own output after decryption.
In a proof-of-concept demonstration, Adversa AI showed how this technique could be used to exfiltrate a user's chat history from Grok.com. The attack was able to transmit the user's name, general location, subscription tier, and the complete set of prompts from the conversation by appending them as URL parameters.
Adversa AI informed xAI about the vulnerability on June 3, 2026, both directly and through its HackerOne bug bounty program. While xAI acknowledged the report, a mitigation timeline was not provided. Follow-up attempts to raise the issue were made on August 4 and August 10. As of August 19, the technique reportedly remained effective against Grok.com. xAI, which was acquired by SpaceX earlier this year, has not publicly commented on the matter.
Adversa AI also tested cryptographic context injection on Google's Gemini public chat interface. While the Grok-specific exfiltration scenario did not work on Gemini due to its lack of Python access to external websites, the researchers were able to bypass Gemini's safety filters. They successfully prompted Gemini to generate content that would normally be blocked, such as instructions for building an incendiary weapon.
Google was not informed of this specific attack, as its vulnerability disclosure program generally considers "jailbreaks"—bypassing guardrails to elicit harmful content—to be out of scope. However, Adversa AI observed a significant decline in the attack's success rate against Gemini by August, suggesting potential filter updates or model version changes may have occurred.
Utevsky drew an analogy between cryptographic context injection and return-oriented programming (ROP), noting that both techniques assemble malicious actions from separately harmless components. In this case, the guardrail inspects individual text artifacts, none of which are inherently harmful, but the malicious intent becomes apparent only when the runtime assembles and executes them. Utevsky emphasized that the agent's runtime, being a general-purpose interpreter, offers broad possibilities for splitting instructions across various encrypted fragments, fetched pages, or tool outputs, none of which would be meaningful in isolation. This highlights a fundamental shift where the guardrail's unit of inspection (a string) no longer aligns with the unit of action (a composed, executed program).
