xAI Grok web chat vulnerable to cryptographic context injection, can exfiltrate chat data

On August 20, security research firm Adversa AI publicly disclosed a new prompt injection vulnerability in xAI's Grok web chat agent named Cryptographic Context Injection. Attackers host a page containing AES-256-GCM-encrypted malicious instructions, a decryption key, and decryption instructions. When a user asks Grok to summarize the page, the model runs the decryption inside its Python sandbox and treats the decrypted output as its own tool output, following the instructions.

In Adversa's proof-of-concept, the decrypted instructions direct Grok to construct a value that looks like a decryption key but actually is the user's name, location, subscription tier, and chat history, appended as URL parameters to an attacker-controlled URL. The model then invokes its own navigation tool to load the URL, exfiltrating data without user confirmation or warning. Adversa lead researcher Rony Utevsky said the issue was reported directly and via xAI's HackerOne bug bounty on June 3, 2026. xAI acknowledged receipt but provided no fix timeline; follow-ups on August 4 and August 10 also received no response. As of August 19, the attack still worked on Grok.com. SpaceX, which acquired xAI earlier this year, declined to comment.

Adversa calls the attack class Cryptographic Context Injection. Its structural root cause is that model safety filters scan input and output text but cannot inspect what the model produces inside its code execution sandbox. Adversa reproduced the same technique on Google Gemini's Deep Thinking mode, bypassing its content safety filters to elicit restricted content, but did not notify Google because jailbreaks are out of scope for Google's disclosure program. The firm concludes that piecemeal patches have been broken by each prior generation of injection research, and the LLM safety industry needs a fundamental rethink of protection boundaries.