Adversa AI has disclosed an attack technique that it says can cause xAI’s Grok chatbot to send a user’s name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page.
The AI security company, which has codenamed the technique “Cryptographic Context Injection,” said the transfer completed without a confirmation step and with no visible warning in its proof-of-concept demonstration.
There is no patch, no CVE identifier, and no user-facing workaround, and the writeup does not report any exploitation in the wild. Asked which build was tested, Adversa told The Hacker News the target was the Grok web chat at grok.com running Grok 4.5 Fast, and that the attack was reproduced once on August 19, 2026.
The writeup gives no success rate. The company said it has attempted the attack 20 times since June with a 40% success rate, and that the failures came from Grok struggling with the decryption rather than from a flagged prompt or response.
The technique ships the attacker’s instructions as ciphertext rather than readable text, with the page carrying an encrypted JSON object, the key material, and an instruction to decrypt it, which Grok executes in its own Python code execution runtime.
Recovering the plaintext requires running PBKDF2 and AES-256-GCM, which a content classifier does not do at inspection time. Hence, the instructions reach the model’s context as the output of code the model has just executed rather than as fetched web content.
“Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on. Whether a weaker encoding would also bypass a given target’s specific filters is an empirical question,” Rony Utevsky, lead researcher at Adversa AI, said.
The decrypted instructions then direct the agent to resolve its private session context and embed it in a URL it is told to open to “fetch additional context.”
One element of the chain has the model construct an additional “decryption key” that is not key material at all, and whose value is a template string interpolating the name, location, tier, and chat history. Grok then invokes its own navigation tool to load that URL, carrying the data in the request’s query parameters.
Utevsky said the prompts taken in the tested scenario were limited to the ongoing conversation, and that everything extracted was already in the model’s context. The agent’s reach, he said, extends to “whatever it holds in context or can fetch with its tools,” and the company did not test whether it could access other chats, agent memory, or other content.
“The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool; it allows private session metadata and conversation history to be resolved into the inputs of that outbound tool; and it enforces no effective egress boundary or consent gate on this path, and no provenance separation we could observe. The laundered, attacker-controlled instructions reach a privileged egress action unimpeded,” Adversa said.
The company said it first reported the issue to xAI on June 3, 2026, and to xAI’s HackerOne bug bounty program on the same date; that xAI acknowledged the report without providing specifics or a mitigation timeline, and that further contact attempts on August 4 and August 10 drew no response.
Adversa is the only source for the Grok finding, said it is withholding the operational payloads to avoid exploitation, and xAI has not published a statement or advisory on the research as of August 20, 2026.
A second demonstration in the same writeup targets Google’s Gemini in Deep Thinking mode, where a single prompt makes the model decrypt a payload that resolves into a fabricated Python traceback carrying a bogus safety-policy deactivation callback and a first-person reasoning prefix that pre-commits it to the restricted output.
Adversa said the vector produced restricted content and reproduced Gemini’s system instructions, which it identified as Gemini 3 Flash (Web) on the paid tier. Google was not notified, Adversa said, because jailbreaks are out of scope for its disclosure program, and the success rate against the company’s agents had “dropped significantly by August,” with the cause left unattributed between filter updates and model version changes.
The Gemini demonstration was published in substantially the same form five months earlier. Utevsky described the same chain on his personal research site on March 11, 2026, under the name Cryptographic Payload Injection, reporting five out of five independent reproductions and cross-model results in which OpenAI’s GPT-5 failed to parse the decryption instructions and Anthropic’s Claude Sonnet 4.5 flagged the payload as prompt injection after decrypting it.
“The Gemini-related part of the research was conducted in March and has undergone no substantial changes. Today, we are adding a generalization of the technique and its application to Grok,” Utevsky told The Hacker News.
“You do not need to fix this at the model layer. Every control that bounds this attack sits in the harness around the agent: what identity it runs as, what it can reach, what it can write, and what you can replay afterward,” Adversa said.
Teams running agents are advised to perform the following steps –
- Quarantine untrusted content in a context with no tools and no credentials, returning only structured data to the privileged context.
- Gate irreversible and outbound actions, confirming new network destinations, pushes, merges, publishes, and writes outside the workspace with fully resolved arguments rather than templates, and applying a hard deny where no human is present.
- Capture per-session tool traces with resolved arguments, without which there is neither detection nor forensics.
- Alert on the sequence rather than on any single payload, treating an opaque blob paired with instructions to decrypt it as a review signal and never as a blocking filter.
- Make context provenance a procurement requirement and ask vendors whether tool output is separated from the instruction channel.
The development comes as Alexander Panfilov and seven co-authors reported in a preprint published on August 10, 2026, that the encrypted chain-of-thought blocks Anthropic, OpenAI, and Google return to application programming interface (API) clients are interchangeable across sessions, users, and models within a provider’s ecosystem, and that attackers can use the flaw to “execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts.”
Separately, researchers at UC Berkeley, the Ethereum Foundation, and NYU Shanghai found in work presented at USENIX Security 2026 that a two-turn attack in which the model decodes a substitution cipher and is then asked to act on the decoded text succeeded against Grok 3 on all 12 of the malicious intents tested, while the same cipher used without that second activation turn failed on all 12.
xAI’s handling of prompt injection reports against Grok has drawn criticism before. In December 2024, Johann Rehberger demonstrated an end-to-end data exfiltration chain against Grok in the X iOS app, in which an indirect prompt injection caused the assistant to send previous chat information to a third-party server, and said all the issues he reported were closed as “Informational.”
“xAI claims there is no practical impact with the reported vulnerability. I’m not sure how leaking user’s chat messages and IP address is not a vulnerability, the question is more about severity,” Rehberger said.
Updated August 20, 2026 with responses from Adversa AI on the tested build, the success rate, and the scope of the extracted data.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
