Encrypted Prompt Injection Lets Attackers Steal Grok User Data
A researcher at security firm Adversa found a way to make Grok exfiltrate user data by hiding malicious instructions inside encrypted ciphertext. xAI was notified in June 2026. As of this writing in August, the attack still works.
How the Attack Works
Adversa researcher Rony Utevsky named the technique Cryptographic Context Injection. The attacker encrypts malicious instructions using PBKDF2 and AES-256-GCM. Grok's static safety guardrails inspect text inputs and outputs, but they cannot inspect encrypted content at classification time. The ciphertext looks like noise to the filter.
The exploit gap is specific. Grok's guardrail checks its own text inputs and outputs. It does not check the output of its internal code execution sandbox. The encrypted payload gets decrypted inside that sandbox, outside the inspection boundary.
The decrypted instructions tell Grok to construct a fake "decryption key." The value of that key is actually user data: name, location, and chat history. Grok appends it as a URL parameter to an attacker-controlled server and fetches the URL.
xAI Knew in June
Adversa disclosed the vulnerability to xAI in June 2026. The data exfiltration continued working at publication. No patch is confirmed.
Same Technique Broke Gemini Too
Utevsky applied Cryptographic Context Injection to Gemini with different results. The attack bypassed Gemini's safety filters and produced multi-paragraph instructions for incendiary weapons. It also caused Gemini to reproduce its own system instructions, including the directives telling it not to disclose them.
Gemini grew increasingly resistant to the technique in the weeks following discovery. Adversa attributes this to possible filter updates or a model version change, but does not have confirmation either way.
Adversa did not report the Gemini behavior to Google. The reason is procedural: jailbreaks are outside the scope of Google's vulnerability disclosure program.
A Wider Pattern
Adversa frames Cryptographic Context Injection as one instance of a broader attack surface. The common thread is targeting tool outputs, runtime results, and intermediate LLM state rather than direct model inputs. The same week Utevsky published, a separate researcher disclosed a prompt injection attack against Microsoft 365 Copilot for enterprise that exfiltrated passwords from user inboxes.
The underlying problem is architectural. Safety filters are trained on natural language. Anything that moves malicious content out of natural language, whether through encryption, tool output routing, or sandbox execution, has a reasonable chance of evading inspection. Adding more rules to the text classifier does not close the gap.
Source: Arstechnica