A security researcher has demonstrated a zero-click attack that steals users’ entire Grok chat histories by hiding malicious instructions inside AES-encrypted payloads that AI safety filters cannot read.
Rony Utevsky of Adversa AI developed the technique, called Cryptographic Context Injection, which sends instructions as ciphertext that bypasses guardrails designed to catch malicious prompts. The attack was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini.
How the Attack Works
In the Grok scenario, a user asks the chatbot to summarize a webpage. That page contains an encrypted payload with hidden instructions telling the model to decrypt it within its Python sandbox. Once decrypted, the instructions direct Grok to access the user’s private session data, including their name, location, subscription plan, and full chat history.
The stolen data is then placed into URL parameters and sent to an attacker-controlled website through a seemingly normal web request. The user receives no warning and does not need to click anything.
The critical difference from earlier cipher-based prompt injection techniques is what happens during decryption. Previous methods used substitution ciphers, XOR, or base64, which models can decode natively. AES-256-GCM requires the runtime interpreter, and that execution channel is what the attack exploits. Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content.
Gemini Also Vulnerable
The Gemini case uses the same cryptographic trick but targets a different path. A prompt asks Gemini to run a Python script that decrypts data and returns JSON. Instead, the decrypted output contains a fake Python error message with hidden instructions designed to bypass safety rules. Adversa used this to make Gemini generate detailed instructions for building an incendiary device, and also exposed the model’s system instructions.
Adversa reported the Grok vulnerability to xAI on June 3, 2026, and received an initial acknowledgment but no further response. The attack was still working as of August 19. Google’s bug bounty excludes jailbreaks, so the Gemini issue was not formally reported, though Adversa noted the vulnerability rate had dropped sharply since June.
A Systemic Problem, Not a Model Bug
Adversa traced the root cause to Grok’s agentic framework rather than any model-layer failure. The framework allows instructions from untrusted external pages to drive privileged, internet-connected tools while permitting private session metadata to flow into outbound calls without an egress boundary or consent gate.
The firm recommended that untrusted content be processed in a sandboxed context with no tools or credentials, that outbound network calls require explicit user confirmation, and that per-session tool traces with resolved arguments be logged for forensics and detection. Without such controls, the researchers warned, AI agents will continue to be vulnerable to attacks that launder attacker data through trusted runtime execution channels.
discussion