Encrypted prompts show why an agent must remember where data came from
Adversa demonstrated a Grok attack using encrypted webpage content. Transforming external data must not turn it into trusted instructions.
The cover image is an AI-generated editorial illustration. Screens and documents are illustrative concepts.
A webpage can contain instructions that are unreadable until an assistant processes them. Adversa AI’s research on Grok describes encrypted content that the assistant decoded and then followed, allowing information from the session to be sent outward.
The researchers reported that the attack still reproduced on 19 August. That is the status of their dated disclosure, not a verified statement about every current version or configuration.
Decryption does not change the source
The important boundary is between external content and authorised instructions. Text does not acquire authority because a tool decoded it, translated it or returned it inside a well-formatted response.
For an assistant that both reads webpages and holds sensitive context, a later tool call can become the point of disclosure. Looking only at the original webpage misses the action that sends data elsewhere.
We recommend assessing the complete sequence: what the assistant reads, what information is available in the session and which destinations it can contact. The same questions apply to other transformations of untrusted content.
Limit what a browsing task can reach
Keep sensitive material out of sessions and tools that have not been approved to handle it. Where the platform supports narrower permissions, give a research task access to what it needs rather than every connected account.
Check whether consequential tool calls need approval and whether that approval makes the destination and data clear. An unfamiliar link containing session information should not be treated as ordinary browsing merely because the assistant generated it.
The research does not establish that encryption defeats every security control. It shows why inspecting input alone is insufficient when an agent can transform that input and act on it. Review those actions and permissions alongside the prompt.
