Security researcher Rony Utevsky from Adversa AI has developed a new attack technique called Cryptographic Context Injection that bypasses AI safety filters through encrypted payloads. According to the report, the method was demonstrated against two live production systems: xAI's Grok and Google's Gemini. For Grok, the security vulnerability is particularly critical – an attacker can steal a user's complete chat history without requiring any user interaction.
Key Facts
- Attack targets: xAI's Grok and Google's Gemini; Grok vulnerability rated as more severe
- Technique: AES-256-GCM encryption hides instructions from content filters; the model decrypts the payload within its own sandbox
- Data theft: Access to username, location, subscription status, and full chat history
- Distinguishing feature: Zero-click – no user interaction required, no warning displayed
How the Attack Works
The mechanism is deceptively simple: A user is asked to summarize a webpage containing an encrypted payload. Grok visits the page, decrypts the AES-256-GCM payload in its Python sandbox, and executes the hidden instructions within. The system then accesses the user's private session data – including name, location, subscription plan, and complete chat history – and automatically opens a URL containing this information. The user remains unaware of the entire process.
"Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can't read them, then tricks the AI into decrypting and trusting them as its own," states the Adversa AI report.
Why Existing Security Measures Fail
The critical technical distinction from earlier cipher-based prompt injection attacks lies in the decryption process itself. Static security guardrails classify inputs as text – they do not execute them. An attacker ships ciphertext along with key material and a decryption instruction. The model then runs the decryption within its own code execution sandbox.
Earlier techniques such as CipherChat and CodeChameleon used substitution ciphers, XOR, or Base64 – schemes the model can decode natively within its context. AES-256-GCM operates differently: decryption requires a runtime interpreter that no standard content classifier executes during inspection. This gap is precisely what the attack exploits.
"The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent."
The result: stolen data is concealed behind an innocuous request – such as "summarize this page" – and the payload inherits credibility it would never possess if inserted directly into the prompt.
Implications for Decision-Makers
This vulnerability demonstrates that even advanced AI systems in production environments remain susceptible to novel attack classes. For organizations evaluating or deploying Grok or similar frontier models, this is a clear signal: security audits must extend beyond standard prompt injection. The ability of a model to execute code – a feature for productivity – becomes an attack vector here. Organizations should clarify how their AI systems handle encrypted content and whether user data is truly isolated.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
