Encrypted instructions on a web page make Grok hand a reader's chat history to an attacker

What happened

Adversa AI published an attack it calls Cryptographic Context Injection. A web page carries an AES-256-GCM payload under a PBKDF2-derived key, plus the key material and an instruction to decrypt it. A guardrail scanning the page reads ciphertext and finds nothing to block. Grok then decrypts the payload in its own Python runtime, treats the plain text it produced as instructions, and follows them.

In the researchers' proof of concept the decrypted instructions told the model to gather the user's name, coarse location, subscription tier and the full set of prompts in the conversation, interpolate them into a URL and open it, sending the lot to a server the researchers controlled. No click is needed beyond a normal request to summarise the page. Adversa reported it to xAI and HackerOne on 3 June 2026 and says the company acknowledged the report without giving specifics or a mitigation timeline; follow-up attempts on 4 and 10 August drew no response. The researchers say they could still reproduce the attack on 19 August, the day before publication. No CVE has been assigned. The same technique run against Gemini in a thinking mode produced content the safety filters would normally block, though Adversa says its success rate there fell sharply between June and August.