Cryptographic Context Injection: The Technique That Drains Grok's Chat History Without a Click

The Discovery and Targeted Systems

On August 23, 2026, Adversa AI published research on a new attack technique targeting agentic AI systems. Called Cryptographic Context Injection, the technique hides malicious instructions inside text encrypted with AES-256-GCM. The target models, xAI Grok and Google Gemini, were both compromised in tests conducted by researcher Rony Utevsky. Specific product versions were not disclosed, but the attack was demonstrated against production systems.

The attack works because static guardrails, which are supposed to block dangerous prompts, do not execute the text they receive. They only see an encrypted string with no apparent meaning. When the model performs decryption inside its own execution sandbox, however, the attacker's instructions emerge as output of freshly executed code. At that point they are treated as trusted context, not as untrusted external content.

In the case of Grok, the effect was zero-click theft of personal data and the entire chat history. In the case of Gemini, the same logic allowed bypassing safety policies and obtaining detailed instructions for building an incendiary device.

Grok: A Web Page Summary That Drains Chat History

The attack on Grok was described as the more severe of the two. A user asks the model to summarize a web page. The page contains an encrypted payload and instructions to decrypt it. Grok visits the page, performs decryption in the Python sandbox, and follows the hidden instructions. These instructions prompt the model to create a "decryption key" that is actually a template containing the user's private data: name, location, subscription plan, and the entire chat history.

The model then inserts this data as URL parameters to an attacker-controlled domain, under the pretext of retrieving additional context. Exfiltration occurs as part of an apparently normal web request. No click, no warning.

On August 19, 2026, the attack was still reproducible. The report to xAI dates back to June 3, 2026, but the company only provided an initial acknowledgment and never responded again. Until a fix is released, it is prudent to avoid asking Grok to analyze or summarize untrusted web pages.

Gemini: Jailbreak and Exposed System Instructions

In the case of Gemini, the attack uses a Python decryption script that returns a fake error message containing hidden instructions. The sandbox output is treated as trusted context and used to make Gemini generate detailed instructions for an incendiary device. A variant also exposed the model's system instructions.

Unlike Grok, the report to Google was not formally filed because Google's bug bounty program excludes jailbreaks. Adversa AI nonetheless reports a clear decline in Gemini's vulnerability rate since June, suggesting that Google has already adopted countermeasures.

Why Filters Don't See the Payload: The Role of the Runtime

Previous techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, decodable by the model natively without an interpreter. AES-256-GCM cannot be decoded in that way: it requires runtime execution. Recovering the plaintext would require running PBKDF2 and AES-256-GCM, operations that no content classifier performs at inspection time.

When the runtime decrypts the payload, the attacker's instructions appear as output of code just executed by the model, not as untrusted external content. Runtime execution "recycles" attacker-controlled data into instructions treated as trusted. The encrypted payload thus gains a credibility that the same text would not have if pasted directly into the prompt.

The pattern works for both direct and indirect injection, for example through the browsing channel.

The Problem Is in the Agentic Harness, Not the Model

According to Adversa AI, a model-level fix is not needed: all controls reside in the harness around the agent. The problem is structural and attributed to Grok's agentic framework. The framework allows instructions coming from an untrusted external page to drive the invocation of a privileged internet-connected tool. It resolves private session metadata and history into outgoing calls and does not enforce an egress boundary or explicit consent. Adversa compares the problem to SQL injection: the system does not distinguish its own trusted state from attacker-supplied data flowing through the same channel.

The risk is cross-cutting. The technique does not depend on the model but on the harness/agent, so it is potentially applicable to other agentic systems with execution sandboxes and connected tools.

The mitigations recommended by Adversa AI include:

• processing untrusted content in a context with no tools and no credentials, returning only structured data to the privileged context;
• requiring explicit confirmation for outbound network calls and writes outside the workspace, with arguments fully resolved and visible before approval;
• keeping per-session tool traces with resolved arguments to enable forensics and detection;
• basing detection on sequences, not individual payloads: the signal is the chain "untrusted content enters context, code is executed, the agent contacts a host outside its normal dependency graph," not the single encrypted blob.