A newly disclosed prompt-injection technique could turn a routine request to summarize a webpage in xAI’s Grok web chat into a silent data-exfiltration attack, potentially exposing a user’s name, approximate location, subscription tier, and active conversation history.
Security researchers at Adversa AI have dubbed the technique “Cryptographic Context Injection.” The attack targets Grok’s ability to browse webpages and run code through an integrated Python sandbox.
Hidden instructions hosted on an attacker-controlled webpage are encrypted, then decrypted by the assistant’s own execution environment and allegedly treated as trusted internal context.
Zero-Click Grok Attack
According to Adversa AI, its proof of concept was tested against Grok 4.5 Fast on grok.com. The researchers said the chain completed without a confirmation dialog, visible warning, or further action from the victim after the initial request.
Researcher Rony Utevsky said the attack can begin when a victim asks Grok to summarize an attacker-controlled webpage. The page includes an apparently benign encrypted JSON object, cryptographic key material, and a brief instruction asking the AI to decrypt the data using its Python runtime.
The payload relies on PBKDF2 key derivation and AES-256-GCM encryption. This makes it materially different from older prompt-injection evasion methods, such as Base64 encoding, substitution ciphers, or Unicode obfuscation.
An LLM may infer or decode simple transformations from its training data. However, strongly encrypted content cannot be reliably recovered from model weights alone. Instead, the assistant must invoke a code interpreter or sandbox to decrypt the hidden plaintext.
Adversa AI said that once Grok’s Python environment decrypts the payload, the attack exploits a trust-boundary failure. Rather than continuing to treat the recovered instructions as untrusted webpage content, Grok allegedly interprets them as reliable tool output or internal runtime state.
That distinction can give attacker-controlled instructions influence normally reserved for content generated inside the agent’s own environment.
The decrypted prompt directs Grok to retrieve sensitive session information and insert it into what appears to be a “decryption key.” In practice, that key is a template populated with victim-specific data, including active prompt history.
The payload then instructs the agent to navigate to another URL to obtain what is supposed to be additional context. Grok’s browser capability loads an attacker-controlled destination with the harvested information embedded in URL query parameters, allowing the remote server to receive it.
Adversa AI reported the issue to xAI and its HackerOne program on June 3, 2026. The researchers said xAI acknowledged the submission but did not provide a mitigation timeline. Follow-up messages on August 4 and August 10 reportedly received no response.
The team said it could still reproduce the attack chain on August 19. Across roughly 20 attempts since June, the reported success rate was about 40 percent.
Failed attempts were attributed to decryption failures, rather than prompt-injection defenses blocking the payload. There is no CVE, public patch, or evidence of in-the-wild exploitation.
Adversa AI also demonstrated a similar encrypted prompt-injection approach against Google Gemini in Deep Thinking mode. That test used an encrypted blob containing a fabricated Python traceback, fake safety-policy callback, and first-person reasoning prefix.
The research highlights an expanding agentic AI attack surface. Defenses must preserve data provenance, isolate untrusted web content, require approval for unexpected outbound navigation, and detect high-risk chains linking web content, code execution, sensitive context access, and network egress.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
