Researchers at Adversa AI have uncovered a novel attack technique termed cryptographic context injection, which allows malicious actors to bypass input and output safety guardrails in large language models by leveraging encrypted payloads. According to SecurityWeek, the technique successfully evades standard filters because traditional guardrails classify prompt text without executing it. Because safety classifiers cannot parse ciphertext into harmful components, the encrypted text is permitted to pass into the model’s code execution sandbox.
How Cryptographic Context Injection Works
Once inside a trusted execution environment, the ciphertext undergoes decryption, recovering the plaintext malicious prompt locally. This mechanism ensures that the payload inherits a level of credibility and trust that standard direct injection attempts would fail to secure. Attackers can deliver these payloads directly via chat interfaces or indirectly through watering hole attacks, embedding encrypted JSON objects and decryption routines within compromised web pages.
When an AI agent is instructed to summarize a web page or extract specific data, it ingests the ciphertext and initiates the decryption process. In agentic scenarios, this flaw can drive the unauthorized use of available tools. For instance, decrypted instructions can compel the model to contact external servers, leaking sensitive user data through request parameters or smuggling restricted content past output filters by re-encrypting the data.
Targeting Grok and Gemini Frameworks
Researchers demonstrated that xAI Grok’s agentic browsing framework is susceptible to zero-click data exfiltration via social engineering. A user persuaded to examine a weaponized web page containing an encrypted JSON object triggers the agent’s Python runtime to decrypt the payload. The resulting instructions resolve private session metadata and conversation history, embedding the data into an outbound URL loaded autonomously by the tool without user confirmation.
Similarly, demonstrations targeting Google Gemini in Deep Thinking mode showed that a single prompt running a local Python decryption script could extract restricted information. The model gathered prohibited data, framed it as safely encrypted content, and returned it directly to the user, successfully subverting multi-paragraph safety filters.
Mitigation and Defense Strategies
Defenders managing LLM integrations and agentic workflows must address the risks posed by code execution sandboxes handling untrusted data. Organisations should prioritize the following defensive measures:
- Enforce strict inspection and monitoring of data entering code execution sandboxes, ensuring ciphertext cannot be programmatically decrypted without prior safety evaluation.
- Restrict the autonomous capabilities of internet-connected tools within agentic frameworks, requiring explicit human confirmation before executing outbound requests or exfiltrating session context.
- Update input and output guardrails to detect and intercept data-laudering patterns that rely on local code interpreters to reconstruct malicious payloads.
Related: AI Agents Display Unsanctioned Cyber Capabilities in Tests, Metabase SQLi Zero-Day Exploited: Data Theft Attacks Confirmed