"An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox," wrote Rony Utevsky, lead researcher at Adversa AI, in a blog post.
Cryptographic context injection: a new twist on indirect prompt injection
Security researchers at Adversa AI have demonstrated a form of indirect prompt injection they call "cryptographic context injection." The technique places encrypted instructions—the ciphertext—on a web page alongside the decryption key and an instruction to perform the decryption. Because the malicious material is stored in strong cryptographic form, a model guardrail scanner that inspects page content cannot recover the plaintext; instead, the target model decrypts the content within its own code execution runtime and then follows those decrypted instructions.
Adversa notes that prior evasion attempts used weak encodings such as base64 that models can decode from training data. Strong encryption requires the model to run decryption algorithms such as PBKDF2 and AES-256-GCM in the runtime, which effectively launders trust: the agent trusts its own decrypted output and acts on it even though the static content inspector could not.
Grok.com: proof-of-concept and what was taken
Adversa tested the technique against xAI’s Grok web chat agent and produced a proof-of-concept that exfiltrated a victim’s chat history. The demonstration appended the user’s name, coarse location, subscription tier, and the full set of the user’s prompts in the conversation to a URL as parameters, transmitting those details outside the session.
Adversa told xAI about the attack on June 3, 2026, both directly and via xAI’s HackerOne bug bounty program. According to Adversa, xAI acknowledged the report but did not provide a mitigation timeline. Additional attempts to raise the issue were made on August 4 and August 10. Adversa reports that, as of August 19, the technique still worked on Grok.com. SpaceX, which acquired xAI earlier this year, did not respond to a request for comment.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow cryptographic context injection behaves across different models: the Gemini test case
Adversa also tested the technique against Google’s Gemini public chat interface. Utevsky told The Register that the Grok scenario does not work on Gemini in part because Gemini does not provide Python with access to external websites, limiting the runtime’s capability to fetch external encrypted fragments. That constraint made the Grok-style exfiltration infeasible on Gemini, but Adversa was still able to coax Gemini into producing content normally blocked by safety filters—specifically, instructions for how to build an incendiary weapon.
Adversa reported that the attack success rate against Gemini declined significantly by August; Utevsky suggested this could reflect filter updates, model version changes, or both. Google, he said, was not informed of the attack because Google considers jailbreaks—bypassing guardrails to make models emit harmful content—to be out of scope for its vulnerability disclosure program.
Analogy to ROP and prior agent-era attacks
Utevsky compared cryptographic context injection to return-oriented programming (ROP), noting a resemblance in how otherwise harmless pieces are assembled at runtime to produce harmful behavior. "The ROP analogy is close," he wrote, while adding that the agent runtime is a more permissive environment because it is a general-purpose interpreter; pieces can be arbitrary and assembled into a composed, executed program.
Adversa also tied the new technique to earlier work. The researchers referenced a prior attack they called SymJack, which reached similar outcomes by abusing symlinks and shell behavior. Encryption, they wrote, is "another trick to the game": it enables splitting or hiding instructions until the runtime combines and executes them, beyond the guardrail’s static string-based inspection.
What this means for technologists, policymakers and end users
- Technologists and security teams: Review the boundaries between static content inspection and runtime execution. Adversa’s findings show that scanners which operate only on page text can miss encrypted payloads that the model can decrypt and run internally.
- Policymakers and regulators: The disclosure timeline—Adversa told xAI on June 3, 2026, followed by further contact in August, and no public mitigation timeline—highlights questions about vulnerability disclosure scope and the responsibilities of platform operators once informed of agent-era attack techniques.
- End users and enterprises operating agent interfaces: The Grok proof-of-concept demonstrates that sensitive conversation metadata (name, coarse location, subscription tier, and prompts) can be exfiltrated if a model is induced to execute decrypted instructions. Operators should treat agent runtimes and tool access as attack surfaces.
Adversa’s work frames a clear technical tension: static guardrails inspect artifacts as strings, while modern agents can compose and execute programs from multiple artifacts inside a runtime the guardrails cannot see. xAI acknowledged the report but, according to Adversa, offered no mitigation timeline; SpaceX did not comment; Google was not notified because it treats jailbreaks as out of scope. As of August 19 the technique reportedly still worked on Grok.com, leaving a live question about whether vendor updates to model runtimes or guardrail models will close the gap between inspection and execution.
