New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI has disclosed a novel attack technique dubbed “Cryptographic Context Injection” that can cause xAI’s Grok chatbot to exfiltrate a user’s name, approximate location, subscription tier, and ongoing conversation prompts to an attacker-controlled server. The attack is triggered when a user asks Grok to summarize a malicious web page. The page contains an encrypted JSON payload and key material, which Grok decrypts using PBKDF2 and AES-256-GCM within its Python code execution runtime. Because the instructions are ciphertext, content classifiers cannot inspect them at fetch time, allowing the malicious instructions to enter the model’s context as code output rather than web content.

Once decrypted, the instructions direct Grok to resolve its private session context and embed it in a URL that the model is told to open to “fetch additional context.” The URL includes a template string that interpolates the user’s name, location, subscription tier, and chat history. Grok then invokes its navigation tool to load that URL, transmitting the data in query parameters. Adversa noted that the attack completes without any confirmation step or visible warning, and that there is no patch, CVE identifier, or user-facing workaround. The company reported the issue to xAI on June 3, 2026, and to xAI’s HackerOne bug bounty program the same day, but received no specific mitigation timeline and no response to follow-ups on August 4 and August 10.

Adversa also demonstrated a similar attack against Google’s Gemini in Deep Thinking mode, which produced restricted content and reproduced Gemini’s system instructions. However, Google was not notified because jailbreaks are out of scope for its disclosure program. The research also references a preprint by Alexander Panfilov and colleagues showing that encrypted chain-of-thought blocks from major AI providers are interchangeable and can be used for invisible prompt injections. Additionally, researchers from UC Berkeley, the Ethereum Foundation, and NYU Shanghai presented a two-turn attack against Grok 3 at USENIX Security 2026. Adversa recommends that teams running agents quarantine untrusted content, gate outbound actions, capture per-session tool traces, and require context provenance from vendors.