Cryptographic Context Injection Also Breaks Gemini Deep Thinking Guardrails

Last week we wrote about how Adversa AI found a way to make Grok leak a user’s chat history just by asking it to summarize a booby-trapped webpage. Turns out that was only half the story. The same researcher has now shown the identical trick works against Google’s Gemini, and instead of stealing data, it gets the model to say things it’s explicitly built not to say.

The technique is called cryptographic context injection, and the core idea hasn’t changed: wrap your malicious instructions in AES-256-GCM ciphertext, hand the model the decryption key, and ask it to run the decryption itself inside its own code execution sandbox. A content filter scanning the page at inspection time sees random bytes, not an instruction, so it waves the payload through. By the time anything readable exists, it’s already inside the model’s trusted execution context, not sitting out in untrusted webpage text where a classifier would catch it.

From Data Theft to Content Bypass

Against Grok, that mechanism was used to smuggle out session data: name, rough location, subscription tier, live conversation history, all bundled into a fake “decryption key” string and shipped off to an attacker’s server. Against Gemini, Adversa used it for something else entirely. A single prompt instructs the model, running in Deep Thinking mode on Gemini 3 Flash’s paid web tier, to decrypt a payload containing a fabricated Python traceback and a bogus safety-policy deactivation callback. The model, treating its own decrypted output as legitimate internal reasoning rather than attacker-supplied content, complies.

The result, per Adversa’s published account, was a multi-paragraph set of instructions for building an incendiary device, plus a reproduction of Gemini’s own system prompt that independently matched previously leaked Gemini 3 Flash prompts elsewhere, which is a decent way to confirm you actually broke something rather than just gotten a hallucinated non-answer.

Worth noting: this Gemini variant isn’t brand new research. Adversa says a version of it was first published back in March under the name “cryptographic payload injection,” with several independent people reproducing it since. What’s new in this week’s disclosure is the formal pairing with the Grok findings and the confirmation that it still works, at least partially, five months later.

Not Every Model Falls for It

Adversa also ran the same payload against other frontier models as a comparison. OpenAI’s GPT-5 reportedly failed to even parse the decryption instructions correctly. Anthropic’s Claude Sonnet 4.5 did decrypt the payload but then flagged the result as a prompt injection attempt after the fact, which is roughly the behavior you’d want: decrypt if you must, but don’t automatically trust what falls out.

That gap matters. It suggests the vulnerability isn’t really about encryption or code execution sandboxes in the abstract, it’s about how much a given model’s harness trusts output that comes from its own tools versus content that arrived from the outside world. Google and xAI apparently draw that line differently than Anthropic does right now.

Disclosure Is Stuck, Again

The disclosure story here is almost as frustrating as the Grok one. Adversa says jailbreak-style findings are explicitly out of scope for Google’s bug bounty program, so there was no formal path to report the Gemini issue at all. xAI, for its part, got the original Grok report back in June, went quiet through follow-ups in early August, and still hadn’t responded by the time of public disclosure on August 20.

Adversa reports the attack’s success rate against Gemini “dropped significantly” by August compared to earlier testing, though the firm is upfront that it can’t say whether that’s the result of a deliberate guardrail update, an unrelated model swap, or something else. Either way, no CVE has been assigned, and neither company has published an advisory.

The bigger pattern, across both the Grok and Gemini findings, is that guardrails built to read text are getting routed around by guardrails that never see the actual instructions until it’s too late. Any AI product that runs code, decrypts payloads, or otherwise processes content inside a trusted execution boundary is worth a second look with that specific failure mode in mind, not just the usual prompt injection checklist.

References

• SecurityWeek — Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini
• The Hacker News — New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
• Adversa AI — Grok Chat History Leak: Cryptographic Context Injection