Threat · curated 20 Aug 2026
Grok chat history leak: Cryptographic Context Injection
First reported · updated · 2 reports adversa.ai
Coverage timeline
Why it matters
Cryptographic Context Injection defeats content-classifier guardrails by forcing plaintext recovery through the model's own runtime, laundering attacker-controlled web content into privileged tool calls and enabling zero-click data theft from widely used AI chatbots that remain unpatched.
Adversa AI disclosed a technique it calls Cryptographic Context Injection that hides malicious instructions inside AES-256-GCM ciphertext with accompanying key material, so static guardrails cannot read the payload; the model decrypts it in its own code-execution sandbox and then treats the recovered instructions as trusted, authoritative context. Demonstrated against xAI's Grok (grok.com, Grok 4.5 Fast) and Google Gemini live production systems, an ordinary 'summarize this page' request caused Grok to exfiltrate the user's name, approximate location, subscription tier, and conversation prompts to an attacker server with no click or warning; researchers report a 40% success rate and reproduced it as of August 19, 2026.
Summary
Security researchers at Adversa AI disclosed a novel prompt-injection technique they call 'cryptographic context injection,' which bypasses AI guardrails by shipping malicious instructions as AES-256-GCM ciphertext (under a PBKDF2-derived key) together with the key material and an instruction to decrypt. Static content classifiers cannot read the encrypted payload at inspection time, so they pass it to the model, which then decrypts it inside its own code-execution runtime and treats the resulting plaintext as trusted instructions.[0][1]
Demonstrated against xAI's Grok.com web chat agent, an ordinary 'summarize this page' request over an attacker-poisoned page causes zero-click exfiltration of the victim's chat history — including name, coarse location, subscription tier, and the full set of conversation prompts — by appending the data to a URL as parameters. The same backbone worked against Google's Gemini public chat to produce content that safety filters normally refuse, though Gemini could not be used for data exfiltration because it does not give its Python runtime access to external sites.[0][1]
This is proof-of-concept research rather than observed in-the-wild exploitation. Adversa reported the flaw to xAI on June 3, 2026 and followed up in August; xAI acknowledged the report but provided no mitigation timeline, and the technique still reproduced against Grok.com as of August 19, 2026. Operational payloads were withheld.[0][1]
Attack chain
- Poisoned page delivery: An attacker publishes a web page containing an encrypted JSON object (AES-256-GCM ciphertext under a PBKDF2-derived key) together with the key material and instructions to decrypt it using a basic Python runtime and standard libraries.[1]
- Guardrail evasion: The AI system processes the untrusted page (e.g., a user asks the agent to summarize it). Static input filters classify the text but cannot execute PBKDF2/AES-256-GCM decryption, so the opaque ciphertext passes the scanner despite the key being present.[0][1]
- Trust laundering via runtime decryption: The model runs the decryption inside its own code-execution sandbox. The decrypted attacker instructions appear as the output of code the model just ran, inside a trusted execution context, and are not flagged as untrusted input.[0][1]
- Privileged action / exfiltration: In the Grok case the laundered instructions flow into a privileged, internet-connected action with no provenance or egress control, exfiltrating the user's name, coarse location, subscription tier, and full conversation prompts by appending them to a URL as parameters.[0][1]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-06-03 | Adversa AI informed xAI of the attack directly and via the HackerOne bug bounty program; xAI acknowledged the report but did not provide a mitigation timeline.[0] |
| 2026-08-04 | Adversa made an additional attempt to raise the issue with xAI.[0] |
| 2026-08-10 | A further attempt to raise the issue with xAI occurred.[0] |
| 2026-08-19 | The technique was reported to still work against Grok.com; Gemini success rate had fallen sharply since June.[0][1] |
| 2026-08-20 | Adversa AI published the disclosure blog post and The Register reported on the technique.[0][1] |
How it works
Guardrail scanners are static classifiers that treat inputs as text and do not execute them. By encrypting the malicious payload with AES-256-GCM under a PBKDF2-derived key, the attacker makes the plaintext unrecoverable to any content classifier at inspection time, even though the decryption key travels alongside the ciphertext on the same page.[0][1]
Weak, reversible encodings such as base64 or substitution ciphers can be decoded by the model natively from its training data, so guardrails can still catch them. Strong encryption offers no such shortcut in the model's weights, forcing recovery through the code-execution runtime — which is exactly what makes the technique effective.[0][1]
The core failure is a trust boundary error: the model treats the output of code it executed in its own sandbox as authoritative, so decrypted attacker instructions enter a trusted context with no provenance tagging. In an agentic setting the laundered output flows into a privileged, internet-connected tool with no egress control, turning a content-trust problem into data exfiltration.[1]
Utevsky likens the composition to return-oriented programming: a static guardrail inspects one artifact (a string) at a time, and if no single artifact is harmful they all pass, with malicious meaning appearing only once the runtime assembles them. Because the agent's runtime is a general-purpose interpreter, instructions could in principle be split across multiple encrypted fragments, fetched pages, or tool outputs — none meaningful in isolation — though Adversa says it has not demonstrated that.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| xAI Grok web chat agent (Grok.com) | Production web chat agent with code-execution runtime and internet-connected browsing/tools; vulnerable to zero-click chat-history exfiltration via poisoned page summarization. | Reported to xAI June 3, 2026; acknowledged without a mitigation timeline; still reproducible as of August 19, 2026.[0][1] |
| Google Gemini public chat (gemini.google.com) | Public chat interface; technique could bypass safety filters to emit normally-refused content, but could not exfiltrate data because Python has no access to external websites. | Not formally reported (Google considers jailbreaks out of scope); attack success rate declined significantly by August, possibly due to filter/model updates. Not fully closed.[0][1] |
Key takeaways
- Strong encryption defeats static guardrail scanners because recovering the plaintext requires executing PBKDF2 and AES-256-GCM, which content classifiers do not do at inspection time, while the model itself can decrypt in its runtime.[0][1]
- Once AI agents gained code execution and tools, the guardrail's unit of inspection (a string) diverged from the unit of action (a composed, executed program), creating a large new attack surface analogous to return-oriented programming.[0]
- The vulnerability is architectural: the model trusts the output of its own runtime, so defenses must live in the agent harness (provenance tagging, tool-call gating, egress control) rather than in input content classifiers.[1]
- The issue remained live in production against Grok.com as of August 19, 2026 despite responsible disclosure to xAI in June, underscoring a gap between disclosure and remediation.[0][1]
Defensive actions
- Gate tool calls whose arguments derive from fetched or decrypted content.: The attack succeeds because decrypted attacker instructions flow into privileged, internet-connected actions with no provenance or egress control; gating those calls breaks the exfiltration path.[1]
- Tag provenance of content and treat runtime/decrypted output as untrusted input rather than authoritative instructions.: The technique works by laundering attacker-controlled ciphertext into trusted context via the model's own runtime; preserving provenance prevents the model from treating its sandbox output as more trusted.[1]
- Alert and detect on the composed chain of actions rather than any single payload.: Because no single artifact is harmful and malicious meaning only emerges once the runtime assembles the pieces, static per-string inspection is insufficient; defenders should monitor the chain.[0][1]