Security researchers at Adversa AI have found a new prompt-injection technique that successfully tricks xAI's Grok web chat agent into following malicious instructions hidden on a web page. The method, dubbed "cryptographic context injection," gets around guardrail filters by encrypting the malicious payload so it looks unreadable to input scanners, then supplying the model with a key so it can decrypt and act on the instructions itself inside its own code-execution sandbox. This matters because it shows AI safety filters can be sidestepped not by hiding content, but by making it computationally invisible to classifiers while still fully accessible to the model.

Unlike weak, reversible encodings such as base64, which models can decode natively and which scanners can often catch, this technique relies on genuine encryption (PBKDF2 and AES-256-GCM) that only the model's runtime can unpick, effectively laundering trust through its own output. Adversa demonstrated the flaw by exfiltrating a Grok.com user's chat history, name, coarse location and subscription tier via a URL. xAI was first notified on 3 June 2026 and again on 4 and 10 August, but as of 19 August the exploit still worked and no mitigation timeline had been given; SpaceX, which owns xAI, did not comment. Google's Gemini was found to be less exposed to the exfiltration variant, since its chat interface lacks Python access to external sites, though the encryption trick still let researchers bypass its content-safety filters, including for weapon-building instructions.