Encrypted prompt injection beats Grok's guardrails

Asking Grok to summarize a webpage can be enough to hand your chat history to an attacker. Adversa AI published a zero-click technique last week that hides instructions inside encrypted text on a webpage and gets Grok to do the decrypting itself. The researchers call it cryptographic context injection. xAI had not shipped a fix when the research went public.

The chain is short. An attacker plants a block of AES-256-GCM ciphertext on a page (a strong, standard encryption format, which is the point: no safety filter can read it). Grok’s guardrails scan the page, see noise, and let it through. When the user asks for a summary, Grok decrypts the block in its Python sandbox, the code environment it uses to run scripts, and treats the result as trusted internal data instead of untrusted web content. The hidden instructions then collect the user’s name, approximate location, subscription tier and active prompt history, and pack it all into the address of a link Grok is told to open, which delivers the data to the attacker’s server. Adversa puts the success rate at roughly 40 percent across some 20 attempts since June.

The disclosure timeline is the uglier half of the story. Adversa reported the hole to xAI through HackerOne on June 3 and got an acknowledgement, then silence. Follow-ups on August 4 and August 10 went unanswered, and the attack still reproduced on August 19. There is no CVE, no patch, and no confirmed abuse in the wild so far. SecurityWeek notes that encrypted payloads also produced results against Google’s Gemini in Deep Thinking mode, though with falling success rates through August.

We have written about this pattern twice in the past two weeks, first when poisoned logs hijacked AI agents, then when agent memory files became an infection vector. The lesson repeats: data an AI reads becomes code it runs. Encryption adds a twist that should bother every security team. A guardrail cannot flag what it cannot read, and here the model itself holds the key, so the payload sails past every filter on the way in.

What changes in practice: treat browsing-enabled consumer assistants as an exfiltration channel, not as a productivity tool with a quirk. If people in your business paste customer records or contract terms into Grok, that text sits in the exact session context this attack drains. Start by finding out which assistants your employees use, then set one clear rule: no sensitive data in consumer AI chats that can browse the web. Our report on AI-driven hacking explains why these attacks keep arriving faster than the patches, and mapping this kind of shadow AI use is where our AI security work usually starts.

Talk to me if you want to know which AI assistants your company data is sitting in right now.

Drafted with AI assistance, reviewed and edited by Christian Vik and the FM CyberSecurity editorial team.

Sources

• Adversa AI, “Cryptographic Context Injection: Zero-Click Grok Data Theft,” August 2026
• SecurityWeek, “Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini,” August 2026
• Security Affairs, “Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection,” August 23, 2026