Encrypted Web Instructions Can Make Grok Send Chat Data to an Attacker

Researchers demonstrated an attack that can make Grok decrypt instructions hidden in a webpage, collect a user’s name, location and chat history, and transmit that information to an attacker-controlled server. The attack ran without a warning or confirmation when Grok was asked to summarize the page, according to the researchers’ demonstration.

Adversa AI calls the method Cryptographic Context Injection. It is a prompt-injection technique designed for systems that inspect visible text for unsafe instructions but can also run code or use tools. Instead of putting the harmful command in plain language, the attacker places encrypted text, a decryption key and decryption instructions on a webpage.

The decryption step changes where the instruction is trusted

The visible material can look like an ordinary request to perform cryptography. In the Grok example, it used PBKDF2 and AES-256-GCM. Adversa’s theory is that static guardrails read text entering and leaving the model, but do not run the decryption. Once the plaintext appears as code-execution output, Grok treats it as trusted context and follows it.

That explanation remains a theory, not a confirmed account of Grok’s internal filtering. The researchers said they could not determine why Grok rejected the same instructions in plaintext but followed them after decryption. Their finding is that the encrypted route changed the outcome in the demonstration.

Browsing turns a prompt injection into an exit route

The risk depends on more than a model producing bad text. Grok’s agentic browsing setup can parse content from an untrusted page and use an internet-connected tool. The researchers said a victim could be socially engineered into asking Grok to examine or summarize that page; the resulting request could send private session metadata and conversation history out without visible confirmation.

The technique is not limited to browsing. Researchers said encrypted payloads can also be delivered directly in chat. The browsing case is more consequential because instructions drawn from an outside page can steer a privileged, internet-connected tool using information from a private session.

What the attack changes

• Input screening: the guardrail sees ciphertext rather than the eventual malicious instruction.
• Data handling: decrypted instructions can direct Grok to put sensitive session information into an external URL.
• User approval: the demonstrated Grok attack proceeded without a warning or request for confirmation.

Adversa’s name for the technique points to the wider exposure. The firm says attackers can target not only direct prompts, but also tool outputs, runtime results and intermediate state that a model may treat as part of its working context. That expands the security boundary beyond text a user sees or types.

A related Gemini test is less consistent

Adversa also demonstrated a direct attack on Gemini’s Deep Thinking mode that decrypted a supplied payload and produced restricted content despite input and output filters. The researchers said its Gemini success rate had declined by publication, though the technique remained potentially possible; they could not identify whether filter updates, model changes or both accounted for the change.

The researchers said they did not contact Google because jailbreaks fell outside its vulnerability disclosure program. That leaves the Gemini result as a separate safety-bypass demonstration, rather than a coordinated disclosure case.

The Grok finding has a more immediate disclosure question. Adversa said it notified xAI on June 3 and sought coordinated disclosure again on August 4 and August 10, without receiving a response by publication. Researchers also said Grok still exhibited the behavior after the June notification. Whether xAI has since changed the affected browsing or code-execution path is unresolved.