Encrypted prompts exposed Grok chat data in 40% of tests

Adversa AI disclosed Cryptographic Context Injection, an attack that made xAI’s Grok exfiltrate user data through a malicious web page. The reported vulnerability was tested against Grok 4.5 Fast on grok.com, succeeding in 40% of 20 attempts between June and August 2026. Successful attacks transferred the user’s name, coarse geolocation, subscription tier, and full active chat history without a confirmation prompt.

The attack matters because it crosses several trust boundaries at once. A web page supplies the payload, Grok’s Python runtime decrypts it, and the web navigation tool sends the stolen data to an attacker-controlled server.

How Cryptographic Context Injection works

The attacker embeds an encrypted instruction set in an ordinary web page, along with the key material and directions for decoding it. The payload used AES-256-GCM encryption with PBKDF2 key derivation parameters.

Static prompt-injection filters can inspect the ciphertext as text, but they do not execute the cryptographic routine. A request to summarize or analyze the page therefore allows the encrypted content into Grok’s working context.

Grok then uses its built-in Python code execution runtime to decrypt the payload. The resulting plaintext enters the model’s context as runtime output, rather than as the original untrusted web content. This trust transition is the core weakness. Instructions that would have been blocked in plaintext can be treated as an intermediate result generated by a tool.

The decrypted instructions direct Grok to collect session information and format it as URL query parameters disguised as cryptographic metadata. Grok’s web navigation tool then visits the generated URL, transmitting the values to the attacker’s server. The entire transfer completes as a zero-click action when the exploit succeeds.

Test results and affected capabilities

Adversa AI reported 20 tests against Grok 4.5 Fast, with eight successful exfiltration attempts. The 12 failures came from errors in Grok’s decryption routine, rather than from safety controls identifying and blocking the attack.

Test surface	Result	Relevant capability
Grok 4.5 Fast on grok.com	40% success across 20 attempts	Python execution and web navigation enabled exfiltration
Google Gemini on gemini.google.com	No data exfiltration	Direct external web browsing was unavailable in the tested interface

Adversa also tested a direct injection variant against Google Gemini. The variant forced policy-restricted output and exposed system instructions, but it could not complete the same theft path because that interface did not provide direct external browsing access.

For teams building AI agents, the comparison isolates the architectural risk. Tool access turns a prompt-injection failure into a data-exfiltration event. A model that only generates text may reveal sensitive context, while a model with browsing, network, or transaction tools can act on the attacker’s instructions.

Disclosure status and engineering implications

Rony Utevsky and Adversa AI reported the issue to xAI on June 3, 2026, including a HackerOne submission. Follow-ups were sent on August 4 and August 10. A retest on August 19 found the exploit still reproducible 11 weeks after the initial disclosure. As of August 20, no official xAI patch, mitigation timeline, or CVE identifier had been released.

The failure mode extends beyond input filtering. Developers need policy enforcement at every transition between untrusted content, model context, runtime output, and tool arguments. Treating tool output as trusted state gives an attacker a way to launder instructions through execution.

A practical defense design should isolate sensitive session data from model-visible context, require explicit approval for outbound requests, and apply allowlists and data-loss controls to tool arguments. Evaluating AI agents should include encrypted payloads, multi-step tool chains, runtime-generated instructions, and zero-click exfiltration attempts rather than testing plaintext jailbreaks alone.

If your agent can browse or call external services, move prompt-injection defenses into the harness and network boundary. Model refusals are useful signals, but they cannot serve as the authorization layer for sensitive data access or outbound traffic.