Grok AI Vulnerable to 'Cryptographic Context Injection' Prompt Attacks
Researchers unveil a novel prompt injection technique for xAI's Grok, using encrypted instructions embedded on web pages to bypass AI guardrails and execute malicious commands.
Security researchers at Adversa AI have demonstrated a new and sophisticated method for attacking large language models (LLMs), specifically targeting xAI's Grok chatbot. Dubbed "cryptographic context injection," this technique allows attackers to embed encrypted malicious instructions within ordinary web pages. When Grok processes these pages to summarize their content, it decrypts and executes these hidden commands, potentially leading to data exfiltration or the generation of harmful outputs.
The core of the attack lies in its ability to circumvent existing AI safety mechanisms. Standard indirect prompt injection attacks often rely on carefully crafted text that tricks the AI into misinterpreting its instructions. However, modern AI models have developed guardrails to detect and block such attempts. Adversa's method bypasses these guardrails by encrypting the malicious payload. While AI model scanners cannot interpret the encrypted text, the presence of an accompanying encryption key on the same page allows the Grok model itself, within its runtime environment, to decrypt and understand the hidden instructions.
"An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox," explained Rony Utevsky, lead researcher at Adversa AI. He further noted that while guardrail scanners might see the encrypted text and the key, they lack the capability to perform the complex decryption process (AES-256-GCM and PBKDF2) required to reveal the plaintext instructions. This allows the malicious content to pass through inspection undetected.
Unlike weaker encoding methods like base64, which LLMs can often decode natively due to their training data, strong encryption requires actual code execution to break. This means the AI model's own runtime becomes the vector for executing the attack. The model, trusting its own internal processes, effectively launders the malicious instructions, treating them as legitimate commands. In a proof-of-concept, Adversa demonstrated how this could be used to steal a user's chat history, including their name, approximate location, subscription tier, and all conversation prompts, by appending them as URL parameters.
While the primary demonstration targeted Grok, Adversa also tested the technique against Google's Gemini. In Gemini's case, the full data exfiltration scenario was not possible due to limitations in its Python environment's access to external websites. However, the researchers were still able to use cryptographic context injection to make Gemini generate content that would normally be blocked by its safety filters, such as instructions for building an incendiary weapon.
Adversa AI reported the vulnerability to xAI on June 3, 2026, through direct contact and its HackerOne bug bounty program. xAI reportedly acknowledged the report, but as of August 19, the technique was still functional. Further attempts to raise the issue were made on August 4 and August 10. SpaceX, which recently acquired xAI, did not respond to requests for comment. Google was not formally notified, as they consider jailbreaking attempts to be outside the scope of their vulnerability disclosure program, though Adversa observed a decline in attack success rates against Gemini by August, possibly due to ongoing filter updates or model changes.
Utevsky drew parallels between cryptographic context injection and techniques like Return-Oriented Programming (ROP), where attackers chain together existing code fragments. However, he highlighted that cryptographic context injection offers more flexibility. The AI's runtime is a general-purpose interpreter, allowing for arbitrary code execution. This means instructions could potentially be split across multiple encrypted fragments or tool outputs, only becoming meaningful when assembled by the runtime, a scenario not yet demonstrated but theoretically possible.
This attack underscores a growing challenge in securing AI systems: the increasing complexity of the interaction between static analysis guardrails and dynamic code execution environments. As AI agents gain more capabilities, including access to tools and code execution, the unit of inspection (text) may no longer be the same as the unit of action (a composed, executed program). Encryption, in this context, becomes another sophisticated trick in the attacker's arsenal to exploit this gap.