Cryptographic Context Injection: Encrypted Prompts Bypass Grok Guardrails

Guardrails scan text. They do not run cryptography. That gap is now a working exfiltration path against one of the biggest chatbots on the internet, and the researcher who found it says it took him a weekend.

Adversa AI’s Rony Utevsky disclosed a technique called cryptographic context injection on August 20, showing how xAI’s Grok can be induced to leak a user’s name, approximate location, subscription tier, and live chat transcript to an outside server, just by asking it to summarize an ordinary looking webpage.

How the Trick Works

The setup is simple once you see it. An attacker posts a page containing an AES-256-GCM encrypted blob and the key material needed to decrypt it, wrapped in instructions telling the model to decrypt and follow what’s inside. A content classifier scanning that page at inspection time sees only ciphertext, gibberish with no readable instructions, so it passes. Utevsky put it plainly: “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time.”

Grok, asked to summarize the page as part of a normal request, runs the decryption itself inside its Python code execution sandbox. Out comes the real instruction set, and the model treats it as legitimate context. From there it’s a standard indirect prompt injection playbook, except the payload was invisible to the filter the entire time it sat on the page.

The exfiltration step is the clever part. The decrypted instructions tell Grok to assemble what looks like a “decryption key” for a follow-up step, except that string is actually stuffed with the user’s session data: name, rough location, subscription tier, and whatever has been said in the conversation so far. Grok appends that string to a URL and fetches it using its own browsing tool, at which point the data lands on infrastructure the attacker controls. No pop-up, no confirmation dialog, nothing that would tip off the person chatting with Grok that anything unusual just happened.

A Weak Spot, Not a One-Off

Adversa ran the attack 20 times against Grok since June and landed it 40% of the time, with most misses coming from Grok fumbling the decryption itself rather than any security control catching the attempt. According to reporting on the research, the firm also tried variants of the technique against Microsoft 365 Copilot, where it managed to exfiltrate a password, and against Google Gemini, where it briefly got the model to produce content normally blocked by safety filters before Gemini’s success rate against the attack dropped off, plausibly from a filter or model update made along the way.

That inconsistency across platforms is the real story here. Cryptographic context injection isn’t a Grok-specific bug, it’s a structural blind spot in how guardrails are built. Every major deployment scans input as static text and never executes or decrypts anything during that scan. Any model with code execution and a way to reach the network, which describes most agentic assistants shipping in 2026, can in principle be walked through the same sequence: read encrypted instructions, decrypt them locally, act on them, exfiltrate the result through a tool call that never looks malicious on its own.

Disclosure and No Fix Yet

Adversa says it first flagged the issue to xAI on June 3, through both direct outreach and a HackerOne submission, then followed up on August 4 and 10 with no substantive response. When researchers reproduced the attack again on August 19, it still worked. xAI acknowledged receiving the report early on but has not given a mitigation timeline, and no CVE has been assigned. SpaceX, xAI’s parent company, did not respond to press inquiries about the disclosure.

For defenders, the takeaway is uncomfortable but straightforward: filtering text at the point of ingestion isn’t enough once a model can run its own crypto. Anything an agent can decrypt, decode, or otherwise transform before acting on it needs to be treated as untrusted, no matter how opaque it looked when the classifier checked it. Locking down which tools an agent can invoke after processing untrusted content, and requiring explicit confirmation before any outbound network call carrying session data, does more here than another layer of input scanning ever will.

References

• Grok chat duped into swallowing injected instructions — The Register
• New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data — The Hacker News
• New attack bypasses AI guardrails by encrypting malicious prompts — SC Media