Security researchers at Adversa AI have uncovered a new AI attack technique called Cryptographic Context Injection.
The attack uses an AI model’s own code-execution sandbox to hide and deliver malicious instructions. This can bypass traditional safety filters and potentially allow attackers to steal data without any action from the user.
In real-world tests, researchers demonstrated that the technique could:
- Leaks users complete chat histories from xAI’s Grok.
- Bypass security guardrails in Google Gemini.
- Enable zero-click data exfiltration, meaning data could be stolen without the user clicking anything.
How Cryptographic Context Injection Works
Static safety guardrails scan incoming prompts as text. They cannot read or evaluate heavily encrypted data. The attack exploits this gap through a multi-step chain:
1. Obfuscation via Encryption: The attacker encrypts malicious commands using AES-256-GCM with a PBKDF2-derived key, placing the ciphertext and decryption routine on a webpage or direct prompt.
2. Filter Evasion: Standard safety scanners let the payload pass because strong encryption cannot be decoded in-weights by the AI model—forcing recovery through the model’s code interpreter.
3. Trust Laundering: The AI executes the script in its Python sandbox. Once decrypted, the payload emerges as the output of the model’s own code rather than untrusted external text.
4. Execution: The AI treats its sandbox output as authoritative internal state, executing the attacker’s hidden commands without user verification.
The Adversa security researcher Rony Utevsky added,
The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool; it allows private session metadata and conversation history to be resolved into the inputs of that outbound tool; and it enforces no effective egress boundary or consent gate on this path, and no provenance separation we could observe. The laundered, attacker-controlled instructions reach a privileged egress action unimpeded.
Impact on Grok and Gemini
- xAI Grok (Zero-Click Data Theft): When a user asks Grok to summarize an attacker-controlled webpage, the payload automatically triggers. Grok uses its sandbox to decrypt instructions, collects private session context (user name, location, subscription tier, and complete chat history), and invokes its browsing tool to transmit the data to an attacker-controlled server—all with zero user clicks or visible warnings.
- Google Gemini (Safety Guardrail Bypass): In direct prompt tests, a decrypted Python payload generated a fake traceback that pre-committed the model to generating restricted content. The payload produced prohibited instructions in plaintext, encrypted them inside the sandbox, and bypassed output filters.
Disclosure & Defense Strategy
Adversa AI reported the vulnerability to xAI in June 2026. As of late August 2026, the exploit remained reproducible against Grok.
Researchers emphasize that fixing this flaw requires harness-level controls around AI agents rather than model-level prompt tuning:
- Strict Tool Gating: Require user confirmation or hard-deny rules for outbound network calls whose arguments derive from fetched or decrypted content.
- Context Quarantine: Run untrusted web fetching inside isolated sandboxes that lack access to credentials or privileged network tools.
- Provenance Tracking: Track context origin to ensure tool outputs are strictly separated from instruction channels.
