New Cryptographic Context Injection technique bypasses AI guardrails via AES-encrypted payloads, leaking full Grok chat histories zero-click
Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini.
“Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”
The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user’s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything.
The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption.
“Static safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.” continues the report. “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. “
Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can’t be decoded that way. Recovery requires the runtime, and that’s the channel the attack depends on.
Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content.
“The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.” states the report. “The same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.”
The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt.
The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a “decryption key,” but the key is actually a template containing the user’s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to “fetch additional context.” The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026.
Adversa traces the structural problem to Grok’s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa’s description maps cleanly to SQL injection: a system that can’t distinguish its own trusted state from attacker-supplied data flowing through the same channel.
The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini’s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini’s system instructions.
Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google’s bug bounty excludes jailbreaks. Adversa said Gemini’s vulnerability rate has nevertheless dropped sharply since June.
For defenders, Adversa’s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there’s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Cryptographic Context Injection)
