← Back to feed
2026-08-22 Prompt Injection TLP:CLEAR

Cryptographic Context Injection Bypasses Grok Guardrails and Enables Zero-Click Chat Exfiltration

Date: 2026-08-22
Tags: prompt-injection

Executive Summary

Adversa AI disclosed Cryptographic Context Injection on 2026-08-20: malicious instructions are shipped as AES-256-GCM ciphertext with the key material, the model decrypts them inside its own code-execution runtime, and the plaintext is then treated as trusted tool output. Against xAI Grok web chat, a routine summarize-this-page request was enough to exfiltrate the user's name, coarse location, subscription tier, and full conversation prompts with no confirmation. Adversa reported the issue to xAI on 2026-06-03 and said the chain still reproduced on Grok as of 2026-08-19; grok.com is not an IOC, and no attacker-controlled infrastructure was published.

Campaign Summary

FieldDetail
Campaign / MalwareCryptographic Context Injection against Grok web chat and Gemini; research disclosure, no malware family
Actor / AttributionVulnerability research by Adversa AI, Rony Utevsky; no in-the-wild actor attributed
TargetUsers of xAI Grok web chat with agentic browsing; Google Gemini public chat was a secondary safety-filter test
VectorIndirect prompt injection via a webpage that carries ciphertext, PBKDF2 parameters, and an instruction to decrypt in the agent's Python runtime
StatusGrok path unfixed as of 2026-08-19 per Adversa; Gemini success rate had fallen sharply by August but was not fully closed
First ObservedReported to xAI and HackerOne on 2026-06-03; public disclosure 2026-08-20

Detailed Findings

According to Adversa AI, static guardrails classify text and do not execute it. An attacker therefore places cryptographically secure ciphertext on a page alongside the key material and a plaintext instruction to decrypt. Recovering the payload requires running PBKDF2 and AES-256-GCM, which a content classifier does not do at inspection time and which the model's weights cannot shortcut. The decrypted instructions then appear as the output of code the model just ran, inside the trusted execution context, and the agent acts on them as if they were its own internal state.

Adversa distinguished this from earlier encoding evasions such as substitution ciphers, XOR, or Base64, which a model can often decode in-weights or in-context with no interpreter in the loop. Strong encryption forces recovery through the code-execution sandbox, which is the trust-laundering step.

Grok zero-click browsing chain

Adversa targeted xAI Grok web chat's agentic browsing framework. The user asks Grok to summarize or analyze an ordinary-looking webpage. Grok fetches the page. The page contains an encrypted JSON object and an instruction to decrypt it with the agent's Python runtime.

Adversa reported that the decrypted instructions tell the agent to resolve private session context, specifically the user's name, coarse location, subscription tier, and the full set of prompts in the conversation, and to embed that context in a URL that the agent is told to open in order to fetch additional context. Grok then invokes its privileged navigation tool and transmits the data in query parameters to an attacker-controlled endpoint.

One disguise in the proof of concept tasked the model with creating an additional decryption key that was not key material. Its value was a template string interpolating the user's private context, later reused as a URL parameter. Adversa stated that the exfiltration completed with no user confirmation and no visible warning.

The Register reported on 2026-08-20 that the same plaintext instructions were refused when presented directly, and followed when delivered as ciphertext that Grok decrypted itself. Ars Technica and SecurityWeek independently covered the disclosure and the still-working Grok reproduction.

Adversa reported the attack to xAI directly and via HackerOne on 2026-06-03. xAI acknowledged the report but provided no mitigation timeline. Adversa said it followed up on 2026-08-04 and 2026-08-10 and had received no further response. As of 2026-08-19, Adversa could still reproduce the attack against Grok. Concrete payloads were withheld.

grok.com, x.ai, and generic Grok share or chat paths are legitimate platform surfaces and are not published as IOCs. No attacker host, hash, or package was disclosed.

Gemini safety-filter bypass

Adversa separately tested a direct-injection variant against Google Gemini public chat in Deep Thinking mode, identified in extracted system instructions as Gemini 3 Flash Web on a paid tier. A prompt instructed Gemini to run a Python script that decrypts supplied ciphertext and emit only a small JSON object, with a fallback to act on a failure message if Python raised.

The ciphertext was crafted so the decrypted plaintext looked like a Python traceback. That fake traceback carried a fabricated callback that appeared to deactivate safety policy and a first-person reasoning prefix that pre-committed the model to producing restricted content, then re-encrypting the answer so output filters saw only ciphertext.

Adversa reported that this produced restricted content Gemini normally suppresses, and that a modified payload extracted Gemini system instructions, including the directive forbidding their disclosure. Adversa did not disclose the finding to Google because jailbreaks are out of scope for Google's vulnerability disclosure program. By August, Adversa said the Gemini success rate had dropped significantly and could not attribute the change to a specific patch, filter update, or model revision.

MITRE ATT&CK Mapping

TechniqueIDContext
Command and Scripting Interpreter: PythonT1059.006Grok and Gemini decrypt attacker ciphertext inside the agent's Python code-execution sandbox.
User Execution: Malicious LinkT1204.001The Grok chain starts when a user asks the agent to summarize or analyze an attacker-controlled page.
Application Layer Protocol: Web ProtocolsT1071.001Decrypted instructions cause Grok to invoke its navigation tool against an attacker URL with session data in query parameters.
Exfiltration Over C2 ChannelT1041Session name, location, subscription tier, and conversation prompts leave in the outbound request.
Inter-Process CommunicationT1559Decrypted tool output is consumed as trusted internal state rather than as untrusted fetched content.

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Adversa withheld operational payloads and did not publish attacker infrastructure. Do not treat grok.com, gemini.google.com, or generic chat and share paths as indicators.

Detection Recommendations

On Grok and other browsing agents, alert on the sequence rather than a single string: untrusted page fetch, followed by code execution that performs PBKDF2 or AES-256-GCM decryption, followed by an outbound navigation or HTTP request whose query string contains session metadata, chat text, or unusually long Base64-like blobs.

Gate irreversible and outbound tool calls whose arguments derive from fetched or decrypted content. Show fully resolved URLs before navigation. Where no human is present, deny new network destinations by default.

Capture per-session tool traces with resolved arguments. Without those traces there is no forensic answer to what the agent read before it exfiltrated.

Quarantine fetched web content in a context with no credentials and no privileged tools; return only structured data to the privileged session. Do not summarize untrusted pages in the same context that can invoke navigation, file access, or credentialed APIs.

Treat opaque ciphertext paired with an instruction to decrypt it as a review signal. It is not a reliable blocking signature on its own, because legitimate crypto tutorials will look similar; the detection value is the decrypt-then-egress chain.

References