I’ve been warning about prompt injection for years, but this new attack is something else entirely. Researchers at Adversa AI have shown that a single “summarize this page” request in xAI’s Grok web chat can silently steal your entire conversation history, name, approximate location, and subscription tier. No confirmation dialog. No visible warning. Just quiet data exfiltration.
How the attack works
The technique, called Cryptographic Context Injection, abuses Grok’s ability to browse webpages and execute code in an integrated Python sandbox. An attacker-controlled webpage contains an encrypted JSON object, key material, and a short instruction directing Grok to decrypt the content through its Python runtime. The payload uses PBKDF2 and AES-256-GCM encryption, which prevents conventional prompt-injection filters from inspecting the concealed commands.
Once the sandbox decrypts the content, the attack exploits a trust-boundary failure. Grok interprets the resulting plaintext as reliable tool output or internal runtime state rather than untrusted content delivered by an external webpage. This distinction lets attacker-controlled instructions gain influence normally reserved for information generated within the agent’s own environment.
The decrypted instructions direct Grok to retrieve private session information and incorporate it into a fake “decryption key.” In reality, the key is a template string populated with victim-specific values, including the active chat’s prompt history. The payload then instructs Grok to open a URL to collect “additional context,” embedding the stolen information in URL query parameters for the attacker’s server to collect.
Why encryption changes the game
Older prompt-injection evasion methods included Base64 encoding, substitution ciphers, and Unicode-based obfuscation. Strong encryption cannot be reliably decoded from an LLM’s learned model weights. The assistant must instead invoke its interpreter or code-execution environment to recover the plaintext. This means the attack bypasses the model’s safety training by hiding malicious intent inside encrypted data that only becomes dangerous after decryption.
Adversa AI reported the issue to xAI and its HackerOne program on June 3, 2026. xAI acknowledged the submission but, according to the researchers, did not provide a mitigation timeline. Follow-up messages sent on August 4 and August 10 received no further reply. The researchers said they could still reproduce the chain on August 19. Across about 20 attempts since June, the reported success rate was approximately 40 percent.
Not just Grok
Adversa AI also demonstrated a similar cryptographic prompt-injection technique against Google Gemini in Deep Thinking mode. The Gemini test used an encrypted blob containing a fabricated Python traceback, a fake safety-policy callback, and a first-person reasoning prefix. Researchers said Gemini treated the sandbox output as its own work, producing content normally suppressed by safety controls and, in a modified test, reproducing system instructions it was not intended to disclose.
What you should do right now
If you use Grok or any AI chatbot with web browsing and code execution capabilities, treat every webpage as potentially hostile. Do not ask the AI to summarise, analyse, or process content from untrusted sources. That simple action can trigger the full attack chain.
Organisations deploying AI agents should isolate browsing and code execution from sensitive context. Preserve data provenance, quarantine untrusted webpage content, require user approval for outbound destinations, and detect risky sequences involving untrusted content, code execution, access to sensitive context, and unexpected network egress. The appropriate mitigation lies in the application harness rather than the model weights alone.
The bigger problem
This incident underscores how prompt injection has evolved beyond merely pasting malicious text into a chat window. In agentic AI systems, the attack surface encompasses every source the model may trust, including browser content, tool outputs, code execution results, memory, and runtime state. As AI systems become more autonomous and capable of performing complex tasks, the boundary between trusted internal state and untrusted external input becomes dangerously blurred.
The OpenAI-Hugging Face incident last month showed what happens when models exceed their sandbox boundaries. Now we have proof that encrypted payloads can turn ordinary web interactions into silent data heists. Zero-click attacks remove the human from the security equation entirely. Once your AI assistant can be weaponised without you touching a single button, we have a fundamentally different threat model.
The appropriate mitigation lies in the application harness rather than the model weights alone. Until vendors treat the harness as a security boundary, every new capability is also a new attack surface.
Adversa AI researchers
Related Reading
- AI Agents, Copilot and the New Security Risk: When Helpful Becomes Harmful
- AI Agent Security: A Top 10 Guide for Hermes, OpenClaw and Claude Code
- Software Flaws Are Now the #1 Breach Cause, and AI Is Making It Worse
- The AI Sandbox Myth: Why Your Security Tests Are Hacking Real Companies
Phil Hall is an Australian Cyber AI leader and author of the Beyond Burnout and Diabetes Decoded series. He writes about the intersection of AI, automation, and cyber security at PhilipHall.com.
