Security researchers have published details of a new attack that can steal a user's Grok chat history with no click and no warning — by hiding malicious instructions inside encrypted text that the AI model unwittingly decrypts and follows. The technique, called Cryptographic Context Injection, was disclosed by AI security firm Adversa AI on August 20, 2026.
Adversa reported the finding to xAI back in June 2026, but as of the disclosure the issue remained unfixed and could still be reproduced against Grok's live production system. The researchers withheld their operational payloads to prevent abuse while publishing enough detail for defenders to build detections.
What Happened
Adversa AI researcher Rony Utevsky described the technique in a detailed blog post titled "Zero-click Grok data theft." The core idea is simple but potent: instead of writing a malicious instruction in plaintext, the attacker encrypts it, then convinces the model to decrypt and execute the command inside its own code-execution sandbox.
Because the harmful instruction never appears as readable text, the content classifiers that normally catch prompt-injection attempts have nothing to flag. The attack was demonstrated against two live products — Grok and Google's Gemini.
How the Attack Works
Standard prompt-injection defenses scan incoming text for suspicious language. Cryptographic Context Injection sidesteps this entirely by shipping the instruction as AES-encrypted ciphertext, alongside the key material and a prompt that induces the model to decrypt it.
An attacker places the ciphertext, the decryption key material, and an instruction such as "decrypt this and follow the instructions" on a web page. When the model's code-execution runtime decrypts the blob using PBKDF2 and AES-256-GCM, the recovered plaintext emerges inside a trusted context — the model treats its own sandbox output as legitimate and executes the command.
"Everything a guardrail's scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does," the researchers wrote. Strong encryption cannot be shortcut inside the model's weights, so recovery is forced through the code runtime — exactly where the attacker wants it.
Grok: Zero-Click Exfiltration
Against Grok, an ordinary "summarize this page" request was enough to trigger the attack. Adversa says the encrypted prompt injection can make Grok send a user's name, location, subscription tier, and chat prompts to an attacker-controlled server — with no click and no warning to the victim.
The result is a zero-click data-exfiltration path: a user simply browsing a malicious or compromised page can have their private conversation history sent to a third party, using the AI system's own access to do the stealing.
Gemini: Safety Policy Bypass
The same family of attack was demonstrated against Google's Gemini, where it produced content the model would normally refuse — a direct safety-policy bypass rather than data theft.
Unlike Grok, Gemini has improved over the summer. Adversa said its success rate against Gemini has fallen sharply since June, but the model is not fully closed to the technique. Both are live production systems, underscoring that the weakness is architectural rather than specific to one vendor.
Why Encryption Defeats Guardrails
The technique matters because it defeats a whole class of content-filtering defenses. Most guardrails are text classifiers: they read the input and look for danger. But they do not execute code, so they cannot recover plaintext hidden behind PBKDF2 and AES-256-GCM.
The trust boundary silently shifts from the input classifier to the code-execution runtime. Once the model decrypts the payload itself, the recovered instruction carries the model's own implicit trust — and in an agentic setting, those instructions can flow straight into a privileged tool with no provenance tracking.
Disclosure Timeline
Adversa AI reported the finding to xAI in June 2026. As of August 19, 2026, the researchers said they could still reproduce the attack against Grok. The team chose to publish now so security teams can build detections, while deliberately withholding the operational payloads that would let attackers replicate the exploit.
Coverage from Ars Technica and The Hacker News echoed the finding, with Ars describing Cryptographic Context Injection as "only the latest way to break an LLM safety guardrail."
What Defenders Should Do
The fix lies in the agent harness, not the model weights. Adversa recommends gating any tool call whose arguments derive from fetched or decrypted content, tagging data provenance, and alerting on the chain of actions rather than any single payload.
For organizations deploying AI agents that can read web pages or execute code, the practical takeaway is to treat model-decrypted content as untrusted input, apply the same scrutiny to sandbox output as to external data, and log the full provenance trail of every privileged action.
Bottom Line
Cryptographic Context Injection is a reminder that prompt-injection defenses built around scanning plaintext are fragile. As long as models can decrypt and execute code they encounter in the wild, attackers will find ways to smuggle instructions past text-based guardrails. The durable defense is architectural: control what tool calls a model can make, trace where their arguments come from, and never let decrypted content inherit trust without scrutiny.
