A newly disclosed prompt injection technique can turn a routine request to summarize a webpage in xAI’s Grok web chat into a silent data exfiltration attack, potentially exposing a user’s name, approximate location, subscription tier, and entire conversation history.
Security researchers at Adversa AI have dubbed the technique “Cryptographic Context Injection.” The attack targets Grok’s ability to browse webpages and run code through an integrated Python sandbox. Unlike older prompt injection evasion methods such as Base64 encoding or Unicode obfuscation, the payload relies on PBKDF2 key derivation and AES-256-GCM encryption, making it impossible for the AI to decode without actively executing code.
How the Attack Works
According to Adversa AI, its proof of concept was tested against Grok 4.5 Fast on grok.com. The chain completed without any confirmation dialog, visible warning, or further action from the victim after the initial request. Researcher Rony Utevsky explained that the attack begins when a victim asks Grok to summarize an attacker-controlled webpage. The page includes an apparently benign encrypted JSON object, cryptographic key material, and a brief instruction asking the AI to decrypt the data using its Python runtime.
Once Grok’s Python environment decrypts the payload, the attack exploits a trust-boundary failure. Rather than treating the recovered instructions as untrusted webpage content, Grok interprets them as reliable tool output or internal runtime state. That distinction gives attacker-controlled instructions influence normally reserved for content generated inside the agent’s own environment.
Sensitive Data Exfiltrated via URL
The decrypted prompt directs Grok to retrieve sensitive session information and insert it into what appears to be a “decryption key.” In practice, that key is a template populated with victim-specific data, including active prompt history. The payload then instructs the agent to navigate to another URL to obtain what is supposed to be additional context. Grok’s browser capability loads an attacker-controlled destination with the harvested information embedded in URL query parameters, allowing the remote server to receive it.
Adversa AI reported the issue to xAI and its HackerOne program on June 3, 2026. The researchers said xAI acknowledged the submission but did not provide a mitigation timeline. Follow-up messages on August 4 and August 10 reportedly received no response. The team said it could still reproduce the attack chain on August 19. Across roughly 20 attempts since June, the reported success rate was about 40 percent.
Failed attempts were attributed to decryption failures, rather than prompt injection defenses blocking the payload. There is no CVE, public patch, or evidence of in-the-wild exploitation at this time.
Broader Agentic AI Risks
Adversa AI also demonstrated a similar encrypted prompt injection approach against Google Gemini in Deep Thinking mode. That test used an encrypted blob containing a fabricated Python traceback, fake safety-policy callback, and first-person reasoning prefix. The research highlights an expanding agentic AI attack surface that goes beyond simple text manipulation.
Defenses must preserve data provenance, isolate untrusted web content, require approval for unexpected outbound navigation, and detect high-risk chains linking web content, code execution, sensitive context access, and network egress. As AI assistants gain browsing, coding, and tool-use capabilities, the boundary between trusted system behavior and attacker-controlled content becomes a critical security frontier.
Sources: GBHackers; Adversa AI; The Hacker News
discussion