Grok chat duped into swallowing injected instructions

xAI's Grok web chat agent is susceptible to a novel form of prompt injection known as cryptographic context injection, according to security researchers at Adversa AI. This technique employs encrypted malicious instructions on a web page, which an attacker uses to manipulate an AI model. The model's input filter fails to detect the encrypted text, allowing it to be passed on to the model for decryption and execution.

Adversa's approach, dubbed "cryptographic context injection," relies on strong encryption that models cannot decode natively. Instead, decryption must occur within the runtime, effectively enabling the model to trust and execute the malicious instructions. Adversa demonstrated this technique by exfiltrating a user's chat history with Grok.com, including sensitive information such as their name, location, and prompts.

While other models like Google's Gemini may be vulnerable to varying degrees, Gemini's environment prevents it from carrying out harmful actions due to its lack of access to external websites. xAI, the company behind Grok, was informed of the attack on June 3, 2026, but no mitigation timeline has been provided.