xAI's Grok web chat agent can be tricked into following harmful commands through a new attack method that uses encryption to hide malicious instructions from safety filters, according to security researchers at Adversa AI. The technique, which Adversa calls "cryptographic context injection," lets attackers place encoded harmful instructions on a webpage along with a decryption key. The attack works because input filters can't read the encrypted text, so they pass it to the AI model, which then uses the key to unlock and execute the hidden commands.
The method builds on a well-known vulnerability called indirect prompt injection, where poisoned web pages trick AI models into performing unintended actions. But this approach adds a crucial layer: strong encryption using PBKDF2 and AES-256-GCM algorithms. Unlike weaker encoding schemes like base64, which models can decode from their training data, strong encryption forces the model to decrypt the instructions through its code execution runtime. In a proof-of-concept demonstration, Adversa showed how the technique could steal a victim's entire chat history from Grok.com, transmitting the user's name, approximate location, subscription level, and all conversation prompts by embedding them in a URL. The attack worked against Grok.com as recently as August 19, 2026, despite xAI being notified on June 3 through direct contact and its HackerOne bug bounty program, with follow-up attempts on August 4 and August 10.
Lead researcher Rony Utevsky at Adversa AI explained that the attack ships ciphertext alongside key material and decryption instructions, and "the model runs that decryption inside its own code execution sandbox." The approach also affected Google's Gemini, though to a lesser extent. While Gemini's public chat interface doesn't grant Python access to external websites—preventing the Grok data theft scenario—Adversa successfully used the technique to bypass safety filters and generate content that's normally blocked, including instructions for constructing an incendiary weapon. By August, the attack success rate against Gemini dropped significantly, which Utevsky suggested could stem from filter updates, model version changes, or both. SpaceX, which acquired xAI earlier this year, didn't respond to requests for comment, and Google wasn't informed because it considers jailbreaks out of scope for its vulnerability disclosure program.
The vulnerability exposes a fundamental mismatch in how AI agents work versus how they're protected. Guardrails scan text one piece at a time, so if no individual fragment appears harmful, everything passes through—but the malicious meaning only emerges once the runtime assembles the parts. Utevsky compared the technique to return-oriented programming, noting that both attacks construct harmful actions from separately harmless components, though cryptographic context injection is "more open" because the agent's runtime is a general-purpose interpreter. An attacker could split instructions across multiple encrypted fragments, fetched pages, or tool outputs—none meaningful alone—and let the runtime combine them. Utevsky noted that Adversa's earlier SymJack attack reached the same vulnerability through symlinks and shell behavior, and encryption simply adds another exploitation method. The core issue, he said, is that once agents gained code execution and tools, the guardrail's unit of inspection—a string—stopped matching the unit of action—a composed, executed program.
The research highlights a growing challenge as AI models gain more autonomous capabilities while safety mechanisms lag behind. Companies racing to deploy agentic AI systems may find that traditional content filtering can't keep pace with attacks that exploit the gap between what guardrails can see and what models can do. For organizations building or deploying AI agents, the choice between expanding model capabilities and maintaining security controls is becoming less of a trade-off and more of an architectural reckoning.