A novel attack technique dubbed “Cryptographic Context Injection” has been disclosed by AI security firm Adversa AI, revealing a method that could enable malicious web pages to extract sensitive user data and conversation history from xAI’s Grok chatbot. The vulnerability, demonstrated against Grok 4.5 Fast, allows an attacker to surreptitiously exfiltrate a user’s name, approximate location, subscription tier, and ongoing chat prompts to an attacker-controlled server without explicit user confirmation or visible warnings.
Adversa AI first reported this issue to xAI on June 3, 2026, via its HackerOne bug bounty program. While xAI acknowledged the initial report, it has not provided specific details regarding a mitigation timeline or released a patch as of August 20, 2026. The absence of an official fix or user-facing workaround leaves Grok users exposed to this potential data exfiltration risk, particularly when interacting with untrusted web content.
Cryptographic Context Injection Attack Details on Grok 4.5 Fast
The Grok 4.5 Fast Cryptographic Context Injection attack leverages the chatbot’s ability to summarize web pages and execute Python code within its runtime. Instead of injecting readable malicious prompts that might be caught by content classifiers, the attacker embeds instructions as ciphertext within an ordinary web page. This encrypted payload includes an encrypted JSON object, the necessary key material, and an instruction for Grok to decrypt it using its internal Python code execution runtime, according to The Hacker News.
How the Attack Unfolds
The core of the attack lies in bypassing Grok’s content filters by presenting instructions in an unreadable, encrypted format. The process involves:
- Encryption Bypass: A standard content classifier, designed to flag suspicious text, does not perform cryptographic operations like PBKDF2 and AES-256-GCM decryption. Therefore, the encrypted instructions reach the model’s context as the output of code it has just executed, rather than as raw, fetched web content.
- Data Resolution and Exfiltration: Once decrypted, these instructions direct the Grok agent to resolve its private session context. This context includes sensitive information like the user’s name, location, and subscription tier. The instructions then command the agent to embed this resolved data, along with the ongoing chat history, into a URL’s query parameters. Grok is then instructed to load this URL using its navigation tool, effectively sending the private data to an attacker-controlled destination. Adversa AI’s lead researcher, Rony Utevsky, confirmed that the extracted prompts were limited to the ongoing conversation.
Adversa AI’s testing of this Adversa AI Cryptographic Context Injection analysis demonstrated a 40% success rate across 20 attempts since June 2026. Failures were attributed to Grok’s struggles with decryption rather than flags for suspicious prompts or responses, suggesting the underlying mechanism for bypassing security filters is effective when decryption is successful.
Broader Implications and Other Targets
While the primary focus of Adversa AI’s disclosure is Grok, a related demonstration targeted Google’s Gemini in Deep Thinking mode, albeit with a different goal: achieving a jailbreak to produce restricted content. This earlier research, published by Utevsky in March 2026 under the name “Cryptographic Payload Injection,” also found that OpenAI’s GPT-5 failed to parse decryption instructions, while Anthropic’s Claude Sonnet 4.5 flagged the decrypted payload as prompt injection.
This technique highlights a systemic challenge in AI agent security, where the ability of models to execute code and interact with external tools can be exploited if not properly bounded. Related research by Alexander Panfilov and co-authors published on August 10, 2026, further suggests that encrypted chain-of-thought blocks returned by major API providers (Anthropic, OpenAI, Google) are interchangeable across sessions and users, potentially enabling “invisible prompt injections” across their ecosystems.
Mitigating Cryptographic Context Injection
Given the lack of an immediate patch from xAI, both users and developers of AI agents must take proactive measures to enhance security.
Recommendations for Grok Users and Developers
- User Caution: Exercise extreme caution when instructing Grok to summarize or interact with web pages from untrusted or unfamiliar sources. This is a critical step in
how to protect Grok chat data exfiltration. - Limited Interaction: Until a patch or clearer guidance from xAI is available, consider limiting Grok’s ability to browse or fetch content from external URLs, especially if sensitive data is involved in the conversation.
- Developer Controls: Adversa AI emphasizes that the solution lies not at the model layer, but in the surrounding “harness around the agent.” Developers should focus on strengthening controls related to:
- Identity and Permissions: What identity the agent operates under and what resources it can access.
- Egress Boundaries: Implementing strict egress filtering and consent gates for any outbound connections initiated by the agent, particularly when driven by untrusted external content.
- Provenance Separation: Ensuring a clear separation of provenance for instructions and data, especially when parsing from untrusted external pages, to prevent attacker-controlled instructions from driving privileged actions.
These recommendations underline the importance of a layered security approach, focusing on the agent’s environment and its interaction with external data sources, rather than relying solely on the model’s inherent safety mechanisms.
Related: OpenAI ChatGPT Lockdown Mode: Mitigating Prompt Injection Exfiltration, AI Agents Vulnerable to Data Leak via Poisoned MCP Tools