Researchers hid an attack inside AES encryption. The AI model cracked it open willingly.

Security researchers at Adversa have discovered a method to bypass AI model filters by embedding malicious instructions within encrypted payloads. By exploiting this vulnerability in xAI's Grok model, researchers were able to demonstrate the attack, which they have named Cryptographic Context Injection. The technique involves encrypting the payload with AES-256-GCM and providing decryption parameters, allowing the model to decrypt the content and follow the instructions.

Adversa tested the method against Grok 4.5 Fast and reported a 40% success rate over 20 attempts since June. In the demonstration, Grok decrypted the encrypted web page containing ciphertext, PBKDF2 parameters, and AES-256-GCM key material. Once decrypted, the page instructed Grok to retrieve user information, such as their name, location, and subscription tier, and submit it to an attacker-controlled URL.

Grok followed the instructions without user approval, exposing sensitive data to the attacker. Interestingly, Grok refused to perform the same attack when the instructions were placed directly on the webpage, suggesting that Grok checks text entering and leaving the model but not plaintext returned by its code execution environment.

This limitation highlights the need for more comprehensive security measures, as the decrypted content can introduce new risks through tool outputs and runtime results. Adversa's findings emphasize the importance of enforcing security controls at every layer, particularly when agents process sensitive information and interact with external systems.