Adversa discloses Cryptographic Context Injection zero-click flaw, Grok and Gemini both affected
On Aug 23 Adversa AI security researcher Rony Utevsky disclosed the Cryptographic Context Injection zero-click technique that hides malicious instructions inside AES-encrypted ciphertext, tricks the AI into decrypting and executing them inside its sandbox, and exfiltrates full chat history. xAI has not fixed it since the June 3 report; the flaw was still reproducible on Aug 19.
On August 23, Adversa AI security researcher Rony Utevsky disclosed a new attack technique called Cryptographic Context Injection. The method hides malicious instructions inside AES-encrypted ciphertext, then tricks the AI into decrypting and executing them inside its own code runtime. Because the decrypted instructions appear to originate from the model's own sandbox, safety filters never flag them.
The proof of concept against xAI Grok is straightforward. A user visits a webpage and asks Grok to summarize it. The page contains an encrypted payload plus instructions telling Grok to decrypt it in its Python sandbox. Grok obliges, decrypts the payload and follows the hidden commands. From there the model accesses the user's private session data: name, location, subscription plan and full chat history. It then constructs a URL containing all that data and opens it automatically to an attacker-controlled server. The user sees nothing: no warning, no consent prompt, no indication anything has left the session.
Utevsky confirmed the attack was still reproducible on August 19. Adversa reported the vulnerability to xAI on June 3; after an initial acknowledgement the company stopped responding and the flaw remains unfixed. Google Gemini proved vulnerable to the same technique. By asking Gemini to run a Python script that decrypts hidden data, an attacker can inject instructions that bypass the model's safety guardrails. Adversa used this to make Gemini generate detailed instructions for building an incendiary device, something the model normally refuses outright.
The root cause in both cases is not a model-layer failure but a problem in the agentic framework surrounding the model. These frameworks allow untrusted external content to invoke privileged tools with internet access and enforce no egress boundary on the resulting data flow. Adversa recommends four immediate enterprise measures: isolate untrusted content in contexts with no tools and no credentials, restrict agent tool access, log every tool invocation, and build detection around sequences rather than payloads.