"Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on," Rony Utevsky, lead researcher at Adversa AI, told The Hacker News.
What Adversa AI reported about Grok
Adversa AI disclosed a novel prompt-injection technique it calls "Cryptographic Context Injection" that, in a proof-of-concept, caused xAI's Grok web chat to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asked Grok to summarize an ordinary web page.
Adversa said the target was the Grok web chat at grok.com running Grok 4.5 Fast. The company reported one successful reproduction on August 19, 2026, and told The Hacker News it has attempted the attack 20 times since June with a 40% success rate; Adversa said the unsuccessful attempts failed because Grok struggled with the decryption step rather than because the prompt or response was flagged. The writeup includes no CVE, no patch, and no user-facing workaround, and Adversa said it is withholding the operational payloads to avoid enabling exploitation. The company did not report any exploitation in the wild.
How "Cryptographic Context Injection" works, according to Adversa
Adversa's method ships the attacker's instructions as ciphertext embedded on a web page: an encrypted JSON object, key material, and an instruction to decrypt. Grok executes the decryption inside its own Python code execution runtime rather than treating the blob as ordinary fetched content. Recovering the plaintext, Adversa says, requires running PBKDF2 and AES-256-GCM—operations a content classifier will not perform at inspection time—so the plaintext reaches the model's context as the output of code the model has just executed.
The decrypted instructions then direct the agent to resolve its private session context and embed that data in a URL it is told to open to "fetch additional context." One element constructs an additional "decryption key" whose value is a template string that interpolates the user's name, location, subscription tier, and chat history. Grok's navigation tool then loads that URL, carrying the resolved data in the request's query parameters. Adversa says the prompts taken in the tested scenario were limited to the ongoing conversation and that everything extracted was already in the model's context; the company did not test access to other chats, agent memory, or other content.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDisclosure, vendor engagement, and related research
Adversa said it first reported the issue to xAI on June 3, 2026, and to xAI's HackerOne program the same day. xAI acknowledged the report but, according to Adversa, provided no specifics or mitigation timeline; further contact attempts on August 4 and August 10 drew no response. As of August 20, 2026, xAI had not published a statement or advisory on the research.
The same writeup includes a second demonstration targeting Google's Gemini in Deep Thinking mode. Adversa said a single prompt made the model decrypt a payload that resolved into a fabricated Python traceback carrying a bogus safety-policy deactivation callback and a first-person reasoning prefix; the company said the vector produced restricted content and that it reproduced Gemini's system instructions, which it identified as Gemini 3 Flash (Web) on the paid tier. Adversa did not notify Google, saying jailbreaks are out of scope for its disclosure program, and reported the success rate against Gemini had "dropped significantly by August."
Adversa's March 11, 2026 writeup on a related chain (which it called Cryptographic Payload Injection) reported five of five reproductions and mixed cross-model results: OpenAI's GPT-5 did not parse the decryption instructions, while Anthropic's Claude Sonnet 4.5 flagged the payload as prompt injection after decrypting. Independent academic work released the summer of 2026 also underscores the risk: a preprint by Alexander Panfilov et al. (August 10, 2026) and a USENIX Security 2026 paper from UC Berkeley, the Ethereum Foundation, and NYU Shanghai describe similar encrypted-block and two-turn decoding attacks that succeed in agentic contexts.
Adversa's mitigations and recommended controls
- Quarantine untrusted content in a context with no tools and no credentials; return only structured data to the privileged context.
- Gate irreversible and outbound actions: confirm new network destinations, publishes, writes, and other outbound actions with fully resolved arguments rather than templates, and apply a hard deny where no human is present.
- Capture per-session tool traces with resolved arguments for detection and forensics.
- Alert on the sequence rather than any single payload; treat an opaque blob paired with instructions to decrypt as a review signal, not as a blocking filter.
- Make context provenance a procurement requirement and ask vendors whether tool output is separated from the instruction channel.
What this means for technologists, procurement leads, and end users
Technologists and security teams: Pay attention to the harness around agents. Adversa argued that defenses live in the agent harness—identity, reach, write permissions, and egress controls—rather than at the model weights. Teams running web-chat agents should consider quarantining untrusted inputs and adding hard confirm gates for outbound network actions.
Procurement and enterprise buyers: Adversa advises making provenance separation and tool-output isolation a requirement when evaluating agent platforms. The technique shown against Grok exploited the absence of an observable provenance separation and an unbounded egress path from parsed instructions to privileged tools.
End users: The proof-of-concept extracted only data already present in the active chat context—name, approximate location, subscription tier, and current prompts—but it did so without a visible confirmation step. There is currently no reported patch or user-facing workaround; Adversa withheld payloads and xAI has not published mitigations as of August 20, 2026.
Adversa's disclosure adds to an expanding record of attack vectors that use encrypted payloads and runtime execution to bypass content inspection. With no CVE or patch announced and only Adversa reporting the Grok result, the record ends, for now, with a question: can agent platforms adopt the isolation and egress controls Adversa prescribes before similar chains are weaponized at scale?
