The attack hides behind an encrypted wrapper
Ask Grok, the artificial intelligence (AI) chatbot built by xAI, to summarize a webpage, and in most cases you get a summary and nothing else. But a security researcher has shown that a specially built page can turn that ordinary request into a theft of your chat history, your name, your approximate location, and your subscription tier, all without a single extra click or warning.
The technique, disclosed on August 20, 2026 by Rony Utevsky, lead AI security researcher at Adversa AI, is called Cryptographic Context Injection. It targets Grok 4.5 Fast as used on grok.com, and as of publication xAI has not shipped a fix.
Why the usual defenses miss it
Most prompt injection attacks hide malicious instructions in plain text on a page, hoping the AI model reads them as commands rather than content. Content filters and safety classifiers exist precisely to catch that plain text.
Utevsky's method skips the plain text entirely. The malicious instructions are encrypted with AES-256-GCM, a standard encryption algorithm, with the decryption key derived using PBKDF2, a widely used key-derivation function. Both the ciphertext and the key material sit openly on the webpage. Because the payload is unreadable garbage to any classifier scanning the page, it sails past content moderation.
The trick is what happens next. Grok has its own Python code-execution sandbox for running scripts as part of answering questions. When Grok processes the page, that sandbox is what decrypts the payload, not a human and not a content filter. Because the plaintext instructions emerge from the model's own tool code rather than from the raw page text, Grok treats them as trusted output and follows them, bypassing the guardrails that would normally flag an instruction buried in a stranger's webpage.
From there, the stolen data, including the user's name, coarse location, subscription tier, and prior chat history, gets appended to a URL. Grok's own browsing tool then autonomously fetches that URL, which is all it takes to send the data to a server the attacker controls. The user never sees an alert, because every step is carried out by Grok itself using capabilities it already has.
In Utevsky's testing, the attack succeeded in roughly 40% of 20 attempts, with the failures attributed to decryption reliability rather than any detection by Grok's safety systems. He also tested the same class of attack against Google's Gemini, which showed reduced susceptibility, a difference The Register's reporting suggests may come down to more recent filter updates on Google's side.
A two and a half month wait for a response
Adversa AI reported the flaw to xAI directly and through HackerOne, the vulnerability disclosure platform, on June 3, 2026. Utevsky says he followed up on August 4 and again on August 10 with no fix timeline forthcoming. He reproduced the working exploit again on August 19 to confirm it was still live before publishing his findings the next day, roughly two and a half months after the initial report.
xAI has acknowledged receiving the report but has given no public timeline for a patch. No CVE (Common Vulnerabilities and Exposures) identifier has been assigned to the flaw as of publication. Adversa AI has withheld the full operational exploit code from its public writeup specifically to prevent copycat abuse while the issue remains open.
What this means for Grok users
There is no user-side setting that closes this hole, because the vulnerability lives in how Grok's own code sandbox and browsing tool interact, not in anything a user configures. Until xAI ships a fix, the safest practical step is to be wary of asking Grok to summarize or analyze pages from sources you do not trust, since that ordinary request is the entire trigger. Treat anything Grok has told you, including account or subscription details, as potentially exposed to a page you asked it to read. This is also a preview of a broader problem: as AI agents gain their own tools for running code and fetching URLs, those tools become a channel attackers can quietly borrow, and encryption on a page is no longer just a defense, it can be a way to hide an attack from the very filters meant to catch it.
