An encrypted payload turns Grok's own navigation tool into the exfiltration path

The mechanism worth arguing about is where the trust label changes. Fetched page text is untrusted, and every agent framework says so. The output of the model's own code sandbox is not treated the same way, and that is exactly where the decrypted instructions turn up ^[5]. Adversa AI puts the root cause in agent design: the framework lets instructions from an untrusted page drive a privileged, internet-connected action ^[6]. Adversa says the laundered, attacker-controlled instructions reach a privileged egress action unimpeded ^[7].

So a stronger input classifier does not help here. To flag the payload at fetch time the filter would have to decrypt it, and the write-up does not say how Grok obtains the key ^[16]. A filter that has to break AES-256-GCM before it can do its job is not a filter. The one checkpoint that sees both halves of the chain is the navigation call, because at that moment the runtime knows the URL and could also know that its parameters were assembled from content fetched during this turn. Gating there costs you the legitimate case where a page genuinely tells the agent where to look next.

Adversa's reliability figure works out to about 8 successes in 20 tries ^[14]. Run the normal approximation on that and the 95 percent interval spans roughly 19 to 61 percent ^[15]. For the point estimate to transfer to another deployment you would need the same Grok build, the same tools enabled, a prompt that actually triggers a fetch, and a page the model reads through; the account gives one aggregate number and no breakdown of which attempts failed ^[16].

The gap between the report and the last successful retest is 77 days ^[13]. Adversa says it followed up twice in that window, on 4 and 10 August ^[9]. By the write-up, what came back was an acknowledgement that the report had been received, with no patch, no CVE identifier and no public advisory ^[10]. The dev.to account is explicit about what it cannot see: "We are not claiming anyone acted in bad faith, and we can't see inside xAI's triage queue" ^[11].

One team, one product, about 20 attempts, and no independent reproduction in this account. That does not establish that every assistant with web access and conversation memory leaks by default. It does describe the three capabilities any such assistant has, which the write-up sums up as read this page, run this, go and fetch that ^[17]. Grok's exposure is the larger one because it is a shipping consumer product attached to a social network with hundreds of millions of accounts ^[12].