Encrypted prompts walk past Grok and Gemini guardrails, and no one owns the bug

Adversa AI has published an attack it calls Cryptographic Context Injection, which smuggles a malicious prompt past AI safety filters as ciphertext and then has the model decrypt it inside its own code execution sandbox ^[1][4]. The technique works against xAI's Grok and Google's Gemini, and neither vendor gave the researchers a usable disclosure path: xAI has not responded since the June 3, 2026 report and two follow-ups, and Google's vulnerability disclosure program treats jailbreaks as out of scope ^[2][3].

The mechanism is a boundary error, not a clever turn of phrase. Guardrails classify prompt text without executing it, so they cannot parse ciphertext into anything harmful and let it through ^[4]. The ciphertext arrives bundled with an instruction and the means to decrypt it, both of which run inside the model's code execution sandbox, and the plaintext prompt is recovered inside the trusted execution context where the guardrails no longer inspect it ^[4]. Adversa's framing is the useful part: "The attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt" ^[5].

Delivery is either direct into the chat or indirect, as a watering hole: an encrypted JSON object and its decryption routine sit in a web page, and an agent told to summarize that page or extract data from it ingests the ciphertext and starts the chain ^[6]. In the Grok case, aimed at the web chat's agentic browsing framework, the researchers describe zero-click data exfiltration ^[8]. The decrypted prompt tells the agent to resolve its private session context, embed that data in a URL, and load the attacker's URL, which the agent does autonomously ^[8]. Session metadata and conversation history end up in the inputs of a privileged, internet-connected tool with no user confirmation and no visible warning ^[9][10]. The researchers put the design failure on the vendor: "The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool" ^[9].

The Gemini case runs the other direction. A single prompt to the public chat interface in Deep Thinking mode has Gemini run a Python script to decrypt supplied ciphertext, and the recovered prompt asks for restricted content framed as something the model will encrypt "for safety" ^[11]. According to Adversa, that produced a multi-paragraph example of restricted content that Gemini's filters normally suppress, including instructions for building an incendiary weapon ^[12]. Encryption defeats the input guardrail on the way in and the output guardrail on the way out ^[13].

Grok was still exploitable when the report was written ^[14]. Gemini's success rate had fallen by August, and the researchers do not know why, offering filter updates, model version changes, or both ^[7][15]. That is the honest state of the disclosure: 68 days between the first report and the second coordination attempt with nothing back from xAI ^[16], and no channel at all at Google ^[17].

Watch whether Google's exclusion of jailbreaks survives contact with agentic tool use, since the same ciphertext trick that produces bad text in a chat window produces an outbound HTTP request in an agent. Watch also for any Grok change that gates privileged egress on user confirmation. Adversa's report includes prevention advice for defenders ^[18].