The Instructions Were Encrypted. Grok Decrypted Them Itself, Then Leaked the User's Chat History.

The guardrail read the whole page. It still could not read the instructions.

A web page carries three things: a block of encrypted text, the key material needed to open it, and a short note asking the AI assistant to decrypt it. A user asks Grok to summarize that page. Grok fetches it, runs the decryption in its own Python sandbox, reads what comes out, and then sends the user's name, approximate location, subscription tier and every prompt from the current conversation to a server run by whoever wrote the page. No click, no confirmation, no warning.

Adversa AI published the technique on 20 August 2026 under the name Cryptographic Context Injection. The interesting part is not that encryption hid the payload. It is which step the encryption forced the model to take, and why that step sits in the one place almost nobody inspects.

How the chain works

Researcher Rony Utevsky reported the Grok finding to xAI on 3 June 2026, and to the company's HackerOne bug bounty programme the same day. xAI acknowledged the report and provided no specifics and no mitigation timeline. Adversa tried again on 4 and 10 August and received no reply. The attack still worked against the live product on 19 August 2026, which is why the researchers published while withholding the working payloads. Malwarebytes covered the disclosure on 25 August. A second variant was demonstrated against Google Gemini, where it produced content the model normally refuses and reproduced the confidential instructions Gemini is told never to reveal.

The mechanism deserves a slow walk, because every piece of it is ordinary. Guardrails, meaning the filters that scan what goes into and out of a model, classify text. They do not execute it. The payload on the page is an AES-256-GCM ciphertext under a key derived with PBKDF2, both of them standard, strong cryptography. Everything a scanner would need is sitting right there on the page, key material included, but recovering the plaintext means actually running the cipher, and no content classifier runs ciphers at inspection time. That is what separates this from older tricks built on base64 or letter substitution: those a model can unscramble in its head, so a filter can be trained to spot them. Real encryption cannot be shortcut that way at all, so recovery has to go through the code interpreter. And once it does, the attacker's instructions arrive not as text fetched from a stranger's website but as the output of a program the model just ran itself. The model treats its own runtime output the way a program treats its own internal state, rather than with the suspicion it reserves for external content. Adversa calls the interpreter a trust laundering channel. The closest old-world analogy is SQL injection, where a system loses track of which half of a query it wrote and which half a stranger supplied.

• The exfiltration was disguised as housekeeping. The decrypted instructions told the agent to build an extra decryption key whose value was really a template string stuffed with the user's private session context, then to open a URL carrying it in order to fetch additional context.
• Grok's own navigation tool did the sending. The private data left in the query parameters of a request the agent made deliberately, through a privileged, internet-connected action with no egress boundary and no consent gate anywhere on the path.
• Adversa did not report the Gemini finding to Google, because jailbreaks fall outside Google's vulnerability disclosure programme. Its success rate against Gemini dropped sharply over the summer, and the researchers say they cannot attribute the change to a filter update, a model change, or both.

What this actually changes

Start with who is exposed today. Anyone using Grok's browsing feature can have a private conversation read by a stranger because they asked for a summary of a page, and the vendor has held the report for nearly three months without shipping a fix or naming a date. Health details, legal questions, draft strategy: whatever is in the conversation is in scope. For your own organisation, though, the chat assistant is not the version to worry about. Adversa's own warning is that every precondition of this attack is stronger for a coding agent, a platform operations agent or a financial one, because for those, code execution is not an exception path but the entire product, outbound network calls are routine, and the credentials within reach are worth far more than a session's metadata. If one of your agents summarises a ticket thread or a fetched page in the same context that holds repository write access, the chain is already built. The systemic shift is what to carry into your next architecture review. Defences have become genuinely good at the classic form of prompt injection, an instruction sitting in plain sight inside a document or a page. This attack puts nothing readable in the prompt at all. It manipulates the wider context a model treats as its own: tool outputs, runtime results, intermediate state. That surface is far larger than the thing the industry has been calling model input, and it is where the next several years of attacks are going to live.

What to do about it

1. Give the context that reads untrusted content no tools and no credentials. Let it hand back structured data only, because an agent that summarises a stranger's page in the same session that can push code has no way to tell the two jobs apart.
2. Gate outbound and irreversible actions on fully resolved arguments, never on templates. The whole attack becomes visible at the moment the agent asks to open a URL, but only if the reviewer sees the actual address with the user's data already interpolated into it.
3. Alert on the sequence rather than the payload. Untrusted content enters, code runs, the agent then contacts a host outside its dependency graph: that chain is the signal, whereas an encrypted blob on its own is a reason to look and never a reason to block.

Bottom line

Every control that stops this sits in the harness around the model, not in the model itself. So ask your AI vendors one question before the next renewal: is tool output separated from the instruction channel, and can the agent refuse a tool call whose arguments came out of fetched content? Most cannot answer that yet, and the answer decides whether a request to summarise a page stays a request to summarise a page. Adversa AI's write-up sets out both demonstrations and the full disclosure timeline, and the 2023 CipherChat paper documents the weaker cipher-based evasion this technique leaves behind.