Grok still hands over whole chat histories 11 weeks after disclosure, Adversa says

Security firm Adversa AI published a report on Thursday saying Grok will hand an attacker a user's name, location, subscription tier and entire chat history, triggered by nothing more than a request to summarise a web page ^[1][2]. Adversa says it disclosed the flaw to xAI on June 3, 2026, followed up on August 4 and August 10, and confirmed the exploit still worked on Grok.com as of August 19 with no mitigation timeline offered ^[3].

That is 77 days between report and confirmed working exploit ^[12]. For anyone routing customer data, deal documents or internal notes through Grok, the practical read is that the whole conversation is the blast radius, not the one prompt that touched the malicious page.

The mechanism is worth understanding because it explains why a content filter does not help. Adversa researcher Rony Utevsky calls it "cryptographic context injection" ^[4]. The attacker leaves only ciphertext, the key, and a note on how to decrypt on the page ^[5]. The filter reads text but never runs it, so the ciphertext passes through; Grok then decrypts it inside its own code sandbox and treats the resulting plaintext as trusted tool output ^[6]. "The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon," Adversa wrote in its disclosure ^[7].

The payload then instructs Grok to assemble something shaped like a decryption key, derived from the user's name, coarse location, subscription tier and the complete set of prompts from that conversation, and to append it to a URL pointing at the attacker's server ^[8]. Grok opens the URL and the data lands in the attacker's logs ^[8].

Two details matter for judging xAI here. Utevsky reported the bug directly and through the company's HackerOne bug bounty programme, so it went through the channel xAI advertises ^[9]. And Adversa says the recommended fix belongs in the agent's harness, not the model, which makes this an engineering decision rather than an open research problem ^[10]. Adversa is publishing the attack mechanism only ^[10].

The report also notes Google's Gemini 3.7 Flash producing material its filters normally block, including instructions for an incendiary weapon and a copy of its own system prompt ^[11]. Utevsky said that version is a direct jailbreak rather than a data exfiltration path, because Gemini's Python environment cannot reach outside websites; Google treats jailbreaks as out of scope for its disclosure programme ^[11]. Adversa says the Gemini success rate dropped sharply by August without the firm being able to identify a filter update, a model change, or both as the cause ^[13]. Quiet patching, in other words, is a thing vendors do.

Grok has form on instruction-following it should not do. Cryptopolitan reported in May that a user on X wrote a message in Morse code that bypassed the bot's safeguards and got Grok to tell the linked agent Bankrbot to send roughly $200,000 in DRB tokens on Base ^[14].

What to watch: whether xAI ships a harness-level change and says so, whether it notifies paying tiers whose conversation contents are the exfiltrated asset, and whether the HackerOne report is resolved or simply left acknowledged. Also watch whether Grok's success rate quietly falls the way Gemini's did ^[13], which would be a fix without a disclosure. Until one of those happens, the assumption for operators is that browsing-enabled Grok sessions carry every prior prompt with them.