Encrypted injection walks past Grok's filters and out through its own browser

Adversa AI says it got xAI's Grok to send a user's name, approximate location, subscription tier and the prompts from the ongoing conversation to an attacker-controlled server, triggered by nothing more than a request to summarize an ordinary web page ^[1]. In the proof of concept, the transfer completed with no confirmation step and no visible warning ^[3]. The delivery method is the part operators should read twice. The hostile page carries an encrypted JSON object, the key material, and an instruction to decrypt it, which Grok runs in its own Python code execution runtime ^[4]. Recovering the plaintext requires PBKDF2 and AES-256-GCM, which a content classifier does not perform at inspection time, so the instructions arrive in the model's context as the output of code the model just ran rather than as fetched web content ^[5]. Adversa calls the technique Cryptographic Context Injection ^[2]. "Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on," lead researcher Rony Utevsky said, adding that whether a weaker encoding would clear a given target's filters "is an empirical question" ^[6]. Once decrypted, the instructions tell the agent to resolve its private session context and put it into a URL it is told to open to "fetch additional context" ^[7]. The laundering step is almost comic: the model is asked to build an extra "decryption key" that is not key material at all, but a template string interpolating the name, location, tier and chat history, after which Grok calls its own navigation tool and carries the payload in the query parameters ^[8]. Adversa's framing is that xAI's framework lets untrusted page content drive a privileged, internet-connected tool with "no effective egress boundary or consent gate on this path, and no provenance separation we could observe" ^[9]. That is the transferable lesson. If your assistant can fetch and can also be told what to fetch, input pattern matching is not a control. The limits matter. Utevsky said everything extracted was already in the model's context, and Adversa did not test access to other chats, agent memory or other content; the agent's reach, he said, extends to "whatever it holds in context or can fetch with its tools" ^[10]. There is no patch, no CVE, no user-facing workaround, and no reported exploitation in the wild ^[11]. Adversa told The Hacker News the target was the Grok web chat at grok.com running Grok 4.5 Fast, reproduced once on August 19, 2026 ^[12]. The writeup gives no success rate; the company said it has run the attack 20 times since June for a 40% success rate, with failures coming from Grok fumbling the decryption rather than from a flagged prompt or response ^[13]. That is roughly eight successes ^[14]. Adversa is the only source, is withholding the operational payloads, and says xAI had published no statement or advisory as of August 20, 2026 ^[16]. Disclosure went to xAI and its HackerOne program on June 3, 2026; Adversa says xAI acknowledged the report without specifics or a mitigation timeline, and follow-ups on August 4 and August 10 drew no response ^[15]. That is 78 days from report to silence ^[17]. The same writeup includes a Gemini demonstration in Deep Thinking mode, where one prompt makes the model decrypt a payload that resolves into a fabricated Python traceback carrying a bogus safety-policy deactivation callback and a first-person reasoning prefix that pre-commits the model to restricted output ^[18]. Adversa says it produced restricted content and reproduced the system instructions of what it identified as Gemini 3 Flash (Web) on the paid tier ^[19]. Google was not notified, because jailbreaks are out of scope for Adversa's disclosure program, and the company says success rates against its agents "dropped significantly by August" without attributing that to filter updates or model changes ^[20].