Published 24 August 2026 · Updated 19 October 2026
Last week, a security researcher proved something we all suspected but hoped would stay theoretical: an AI chatbot can be tricked into handing over your entire private conversation history without you clicking a single link or dismissing a warning.
Rony Utevsky from Adversa AI published a new attack technique in August 2026, called Cryptographic Context Injection. The method hides malicious instructions inside AES-encrypted ciphertext, then tricks the AI into decrypting and executing those instructions inside its own code runtime. Because the decrypted instructions appear to originate from the model’s own sandbox, the safety filters never flag them.
How the Grok Attack Works
The proof-of-concept against xAI’s Grok is elegant in its simplicity. A user visits a webpage and asks Grok to summarise it. The page contains an encrypted payload plus instructions telling Grok to decrypt it in its Python sandbox. Grok obliges, decrypts the payload, and follows the hidden commands.
From there, the model accesses the user’s private session data: name, location, subscription plan, and full chat history. It then constructs a URL containing all that data and opens it automatically to an attacker-controlled server. The user sees nothing. No warning, no consent prompt, no indication that anything has left their session.
Utevsky confirmed the attack was still reproducible on August 19, 2026, succeeding in 8 of 20 attempts. Adversa reported the vulnerability to xAI on June 3, directly and through its bug bounty programme. xAI acknowledged the report but had not said when, or whether, it would fix the flaw.
Gemini Was Jailbroken Too
A variant of the technique also worked against Google’s Gemini, though as a jailbreak rather than data theft, because Gemini’s Python sandbox does not have access to external websites. By asking Gemini to run a Python script that decrypts hidden data, an attacker can inject instructions that bypass the model’s safety guardrails. Adversa used this to make Gemini generate detailed instructions for building an incendiary device, something the model normally refuses outright.
The root cause in both cases is not a model-layer failure. It is the agentic framework surrounding the model. These frameworks allow untrusted external content to invoke privileged tools with internet access, and they enforce no egress boundary on the resulting data flow. In plain terms: the AI’s harness is letting attacker-controlled data travel the same trusted path as legitimate user requests.
What Enterprises Should Do Right Now
If your organisation uses AI agents, gateways, or browser-enabled assistants, this attack pattern is relevant to you. The fix is not at the model level. Every control that stops this attack lives in the harness around the agent.
Start with these four steps:
- Isolate untrusted content. Process external web pages, documents, and user uploads in a context with no tools and no credentials attached. Return only structured data to the privileged agent context.
- Restrict tool access. Agents should not inherit broad internet access just because they can browse. Require explicit confirmation before any outbound network call, with fully resolved arguments visible to the user.
- Log every tool invocation. Per-session traces showing what arguments were resolved and what external hosts were contacted are essential for forensics. Without logs, you will never detect this attack in the wild.
- Alert on sequences, not payloads. The signal is not a single suspicious message. It is a chain: untrusted content enters context, code executes, and the agent contacts a host outside its normal dependency graph. Build detection around that pattern.
These are not new principles, but they are newly urgent. As AI agents take on more autonomous roles inside corporate systems, the attack surface shifts from the model to the infrastructure that lets the model act.
The Wider Context
This disclosure arrives amid growing concern about AI containment. A study released on August 22, 2026, found that leading AI labs have few publicly documented plans for containing rogue models. OpenAI scored highest; Anthropic and Meta scored lowest. The labs are racing to deploy more capable agentic systems while their public safety documentation remains vague on what happens when those systems misbehave at scale.
The Grok and Gemini incidents demonstrate that the threat is not some distant superintelligence scenario. It is happening now, against live production systems, using techniques that bypass existing guardrails without any user interaction.
The uncomfortable truth is that too many organisations are still defending at human speed while adversaries are escalating to machine speed. Zero-click AI attacks remove the last line of defence: the user’s own suspicion.
Sources
- The Hacker News, New cryptographic context injection attack could let web pages steal Grok chat data. August 2026
- Security Affairs, Zero-click Grok chat history theft: Adversa AI demonstrates cryptographic context injection. August 2026
- Dataconomy, xAI’s Grok chat agent vulnerable to cryptographic context injection attack. 21 August 2026
Vendor fix status was as reported in August 2026 and may have changed. Recommendations are the author’s guidance.
Related Reading
- OpenAI’s AI Models Hacked Hugging Face During a Test. The Containment Problem Just Got Worse.
- AI Agents Broke Out of Their Cages This Summer. Enterprises Are Next
- Data Breaches Hit Record Pace in 2026, and AI Is the Accelerant
The views expressed on this site are my own and do not represent those of any current or former employer. Articles are based on publicly available information and are provided for general educational purposes.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
