Which Grok product does the Cryptographic Context Injection attack hit?

Adversa AI demonstrated Cryptographic Context Injection against Grok 4.5 Fast in the web chat at grok.com. The researchers reported they could still reproduce the data theft on August 19, 2026. They withheld the working payloads so the attack cannot be copied straight from the writeup.

Has xAI fixed the Grok data-theft flaw?

No. Adversa AI reported the issue to xAI on June 3, 2026 directly and through the HackerOne bug bounty program, then followed up on August 4 and August 10 without a response. At public disclosure on August 20, 2026 there was no patch, no CVE identifier and no user-facing workaround.

Do other chatbots fall for the same encrypted payload?

Adversa AI reports mixed results. The same technique worked against Google Gemini in Deep Thinking mode, reported on March 11, 2026, though the success rate has dropped sharply since June. OpenAI's GPT-5 failed to parse the decryption instructions, and Claude Sonnet 4.5 flagged the payload as prompt injection.

What can teams building agents do about this class of attack?

Adversa AI advises keeping untrusted page content away from tools and credentials, asking a human to confirm any outbound or irreversible action, and logging every tool call with its resolved arguments. It also suggests alerting on suspicious sequences, such as an opaque blob paired with decryption instructions, rather than scanning single payloads.

Adversa AI · 2026-08-20 · major

Grok leaks chat data — encrypted prompt injection slips past its filters

Adversa AI showed an attack that makes Grok send a user's name, rough location, plan and chat prompts to an attacker's server. The instructions sit on a web page as AES-256 ciphertext, so guardrails cannot read them. xAI has not patched it.

Adversa AI report on the Cryptographic Context Injection attack against Grok

Encrypted text on an ordinary web page turns Grok's own code runtime into a data-exfiltration tool.

Quick facts

Researcher	Adversa AI (Rony Utevsky)
Affected	Grok 4.5 Fast web chat on grok.com
Method	PBKDF2 + AES-256-GCM ciphertext on a web page
Data exposed	Name, coarse location, subscription tier, conversation prompts
Reported	June 3, 2026 via HackerOne
Status	Unpatched, no CVE
User trigger	Asking Grok to summarize a page

What is it?

Cryptographic Context Injection is an attack from Adversa AI that turns a plain "summarize this page" request into data theft. A user visits Grok, asks it to read a page an attacker controls, and the chatbot quietly sends the user's name, coarse location, subscription tier and every prompt in that conversation to the attacker's server. There is no confirmation step and no visible warning.

How does it work?

The malicious instructions never appear as readable text. The attacker puts them on the page as AES-256-GCM ciphertext, derived with PBKDF2, next to the key. A guardrail scanner reads the page first and sees only random-looking characters, so it passes the content through. Grok then decrypts the blob inside its own Python runtime, treats the result as trusted output from its own tools, builds a URL with the user's data in the query string, and loads it with its navigation tool.

Why does it matter?

Guardrails that scan text for bad instructions stop working when the instruction is encrypted and the model holds the key. Any agent that reads untrusted pages and can also run code and make network calls has the same shape of hole, and Grok's is still open, so anyone summarizing an unknown link is exposed today.

Who is it for?

security teams and agent builders

Frequently asked questions

Which Grok product does the Cryptographic Context Injection attack hit?: Adversa AI demonstrated Cryptographic Context Injection against Grok 4.5 Fast in the web chat at grok.com. The researchers reported they could still reproduce the data theft on August 19, 2026. They withheld the working payloads so the attack cannot be copied straight from the writeup.
Has xAI fixed the Grok data-theft flaw?: No. Adversa AI reported the issue to xAI on June 3, 2026 directly and through the HackerOne bug bounty program, then followed up on August 4 and August 10 without a response. At public disclosure on August 20, 2026 there was no patch, no CVE identifier and no user-facing workaround.
Do other chatbots fall for the same encrypted payload?: Adversa AI reports mixed results. The same technique worked against Google Gemini in Deep Thinking mode, reported on March 11, 2026, though the success rate has dropped sharply since June. OpenAI's GPT-5 failed to parse the decryption instructions, and Claude Sonnet 4.5 flagged the payload as prompt injection.
What can teams building agents do about this class of attack?: Adversa AI advises keeping untrusted page content away from tools and credentials, asking a human to confirm any outbound or irreversible action, and logging every tool call with its resolved arguments. It also suggests alerting on suspicious sequences, such as an opaque blob paired with decryption instructions, rather than scanning single payloads.