A new attack technique, dubbed Cryptographic Context Injection, has been demonstrated to bypass artificial intelligence (AI) safety filters, potentially leading to the theft of user chat histories and other sensitive data. The technique, developed by Adversa AI researcher Rony Utevsky, involves embedding malicious instructions within AES-encrypted ciphertext and tricking AI models into decrypting and executing them within their own code execution environments.
The attack was successfully demonstrated against two live production systems: xAI's Grok and Google's Gemini. In the case of Grok, the technique allowed for the exfiltration of a user's full chat history, name, location, and subscription plan without any user interaction or warning. For Gemini, it enabled the generation of content that the model would normally refuse to produce.
The Grok attack unfolds when a user prompts the AI to summarize a webpage. This webpage contains an AES-encrypted payload along with instructions for Grok to decrypt it. Grok then accesses the page, decrypts the payload within its Python sandbox, and follows the hidden instructions. These instructions direct Grok to access the user's private session data, including their name, location, subscription tier, and complete chat history. This information is then embedded into a URL, which Grok automatically opens, effectively sending the data to an attacker-controlled website. This process requires no user clicks or warnings. Adversa AI confirmed the attack was still reproducible on August 19, 2026.
The core innovation of Cryptographic Context Injection lies in its use of robust cryptographic methods like PBKDF2 and AES-256-GCM. Unlike previous prompt injection techniques that relied on simpler encoding schemes such as substitution ciphers, XOR, or Base64, which models could decode natively, AES-256-GCM requires a runtime environment for decryption. This means that static safety guardrails, which primarily classify inputs as text and do not execute them, are bypassed. The attacker supplies the ciphertext, key material, and decryption instructions, and the model's runtime executes the decryption. Once decrypted, the attacker's instructions are treated as trusted output from code the model itself just ran, effectively "laundering" attacker-controlled data into trusted commands.
Adversa AI attributes the Grok vulnerability to its agentic framework, rather than a model-layer flaw. The framework permits instructions from untrusted external pages to trigger privileged, internet-connected tools and allows private session metadata and conversation history to be resolved into the inputs of outbound calls without enforcing egress boundaries or consent gates. This structural problem is likened to SQL injection, where a system fails to distinguish its own trusted state from attacker-supplied data flowing through the same channel.
The Gemini demonstration utilized the same underlying cryptographic trick but for a different purpose. A prompt instructed Gemini to execute a Python script that decrypts data and returns a small JSON result. However, the decrypted data contained a fabricated Python error message with concealed instructions designed to circumvent Gemini's safety protocols. Since Gemini considers the sandbox output as trusted context, these instructions could influence its behavior. Adversa AI used this method to compel Gemini to generate detailed instructions for constructing an incendiary device and also to expose Gemini's system instructions.
Adversa AI reported the Grok issue to xAI on June 3, 2026, and received an initial acknowledgment, but no further response. The attack remained functional shortly before Adversa's public disclosure. The Gemini issue was not formally reported to Google due to the company's bug bounty program excluding jailbreaks. However, Adversa noted a significant decrease in Gemini's vulnerability rate since June.
For defenders, Adversa AI suggests that the solution does not lie in model-layer fixes. Instead, controls should be implemented within the agent's surrounding harness. Untrusted content should be processed in an isolated context devoid of tools and credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should necessitate explicit confirmation, with all resolved arguments visible prior to approval. Furthermore, per-session tool traces with resolved arguments should be logged to enable forensics and detection, with alerts triggered by sequences of events rather than individual incidents.
