Last week, a security researcher proved something we all suspected but hoped would stay theoretical: an AI chatbot can be tricked into handing over your entire private conversation history without you clicking a single link or dismissing a warning.
Rony Utevsky from Adversa AI disclosed a new attack technique on August 23, 2026, called Cryptographic Context Injection. The method hides malicious instructions inside AES-encrypted ciphertext, then tricks the AI into decrypting and executing those instructions inside its own code runtime. Because the decrypted instructions appear to originate from the model’s own sandbox, the safety filters never flag them.
How the Grok Attack Works
The proof-of-concept against xAI’s Grok is elegant in its simplicity. A user visits a webpage and asks Grok to summarise it. The page contains an encrypted payload plus instructions telling Grok to decrypt it in its Python sandbox. Grok obliges, decrypts the payload, and follows the hidden commands.
From there, the model accesses the user’s private session data: name, location, subscription plan, and full chat history. It then constructs a URL containing all that data and opens it automatically to an attacker-controlled server. The user sees nothing. No warning, no consent prompt, no indication that anything has left their session.
Utevsky confirmed the attack was still reproducible on August 19, 2026. Adversa reported the vulnerability to xAI on June 3, but after an initial acknowledgement, the company stopped responding. The attack remains live.
Gemini Falls Too
Google’s Gemini proved vulnerable to the same technique. By asking Gemini to run a Python script that decrypts hidden data, an attacker can inject instructions that bypass the model’s safety guardrails. Adversa used this to make Gemini generate detailed instructions for building an incendiary device, something the model normally refuses outright.
The root cause in both cases is not a model-layer failure. It is the agentic framework surrounding the model. These frameworks allow untrusted external content to invoke privileged tools with internet access, and they enforce no egress boundary on the resulting data flow. In plain terms: the AI’s harness is letting attacker-controlled data travel the same trusted path as legitimate user requests.
What Enterprises Should Do Right Now
If your organisation uses AI agents, gateways, or browser-enabled assistants, this attack pattern is relevant to you. The fix is not at the model level. Every control that stops this attack lives in the harness around the agent.
Start with these four steps:
- Isolate untrusted content. Process external web pages, documents, and user uploads in a context with no tools and no credentials attached. Return only structured data to the privileged agent context.
- Restrict tool access. Agents should not inherit broad internet access just because they can browse. Require explicit confirmation before any outbound network call, with fully resolved arguments visible to the user.
- Log every tool invocation. Per-session traces showing what arguments were resolved and what external hosts were contacted are essential for forensics. Without logs, you will never detect this attack in the wild.
- Alert on sequences, not payloads. The signal is not a single suspicious message. It is a chain: untrusted content enters context, code executes, and the agent contacts a host outside its normal dependency graph. Build detection around that pattern.
These are not new principles, but they are newly urgent. As AI agents take on more autonomous roles inside corporate systems, the attack surface shifts from the model to the infrastructure that lets the model act.
The Wider Context
This disclosure arrives amid growing concern about AI containment. A study released on August 22, 2026, found that leading AI labs have few publicly documented plans for containing rogue models. OpenAI scored highest; Anthropic and Meta scored lowest. The labs are racing to deploy more capable agentic systems while their public safety documentation remains vague on what happens when those systems misbehave at scale.
The Grok and Gemini incidents demonstrate that the threat is not some distant superintelligence scenario. It is happening now, against live production systems, using techniques that bypass existing guardrails without any user interaction.
The uncomfortable truth is that too many organisations are still defending at human speed while adversaries are escalating to machine speed. Zero-click AI attacks remove the last line of defence: the user’s own suspicion.
