A regular request to retell the web page may end with the transmission of the history of Grok correspondence to a foreign server. Adversa AI researchers have found a way to hide malicious commands from protective filters with encryption, and then make Grok itself decrypt the instructions and execute them already inside the trusted environment. The method is called Cryptographic Context Injection, or cryptographic context injection.
The attack develops a long-known problem of indirect injection of the industrial. The attacker places the command not in the message for the chat-bot, but in the external source, for example on the site, which the user asks to study or retell. Modern protective filters have learned to notice many suspicious instructions in the open text, so Adversa AI specialists decided to hide the contents of the team with the help of full encryption.
The malicious page contains an encrypted block, materials for receiving the key and a command to decrypt. The filter checks the page as a regular text and sees a meaningless set of characters. To restore the content, you need to perform PBKDF2 and AES-256-GCM than the static classifier does not deal with the input data. Grok, on the other hand, is able to run the code in its own execution environment, so the model independently decrypts the hidden block.
The main problem appears after the decryption. The resulting command is no longer as a suspicious text from an external site, but as a result of the work of its own software environment Grok. The model begins to perceive the result of code execution as part of a trusted context and follows hidden instructions. Researchers call this transition a “trust laundering”: untrusted data passes through the execution medium and returns models in a form that the defense mechanisms pay less attention to.
In the Adversa AI demonstration, the attacker placed the prepared block on a regular web page, after which the user asked Grok to analyze the contents. The decrypted command forced the chatbot to collect the username, the approximate location, subscription level, and all the requests from the current conversation. Grok then placed the information in the URL parameters and independently accessed the address controlled by the researchers. The transfer took place without additional confirmation and without visible warning.
The principle is different from old attempts to hide commands with Base64, rearrange characters, and simple ciphers. Language models are often able to independently recognize and decode such designs thanks to these training. Strong encryption deprives the model of such a short path and forces you to refer to the code execution environment. The protective filter checks the original encrypted text, and this instruction appears later, already inside the working context of the agent.
Adversa AI tested a similar approach on the public version of Google Gemini. It was not possible to completely repeat the scenario of theft of Grok's correspondence, as the available Gemini environment Python could not turn to arbitrary external sites. At the same time, the cryptographic injection of the context allowed to bypass some of the security restrictions and receive answers that the service usually blocked. By August, the efficiency of the bypass has significantly decreased, which specialists associate with possible changes in filters, models or both components.
The researchers reported the xAI problem on June 3, 2026, directly and through the HackerOne Rewards Program. The company confirmed receipt of the report, but according to Adversa AI, did not report a time frame for the problem. Additional appeals were followed on 4 and 10 August. The audit on August 19 still allowed to reproduce the attack on Grok.com. Public information about the operation of the method against real users researchers do not lead, the finished working useload Adversa AI also decided not to publish.
Previously, there was a broader problem of indirect injections of industrialists: the risk is growing sharply when AI gets not only access to external content, but also the ability to run code, access the network and work with user data. Cryptographic Context Injection shows another weak part of the architecture: filtering of the input text is not enough if the malicious instruction may occur later as a result of code execution. Protection requires control of the origin of the data, restrictions on external requests and separate verification of actions before transmitting information outside the service.
The attack develops a long-known problem of indirect injection of the industrial. The attacker places the command not in the message for the chat-bot, but in the external source, for example on the site, which the user asks to study or retell. Modern protective filters have learned to notice many suspicious instructions in the open text, so Adversa AI specialists decided to hide the contents of the team with the help of full encryption.
The malicious page contains an encrypted block, materials for receiving the key and a command to decrypt. The filter checks the page as a regular text and sees a meaningless set of characters. To restore the content, you need to perform PBKDF2 and AES-256-GCM than the static classifier does not deal with the input data. Grok, on the other hand, is able to run the code in its own execution environment, so the model independently decrypts the hidden block.
The main problem appears after the decryption. The resulting command is no longer as a suspicious text from an external site, but as a result of the work of its own software environment Grok. The model begins to perceive the result of code execution as part of a trusted context and follows hidden instructions. Researchers call this transition a “trust laundering”: untrusted data passes through the execution medium and returns models in a form that the defense mechanisms pay less attention to.
In the Adversa AI demonstration, the attacker placed the prepared block on a regular web page, after which the user asked Grok to analyze the contents. The decrypted command forced the chatbot to collect the username, the approximate location, subscription level, and all the requests from the current conversation. Grok then placed the information in the URL parameters and independently accessed the address controlled by the researchers. The transfer took place without additional confirmation and without visible warning.
The principle is different from old attempts to hide commands with Base64, rearrange characters, and simple ciphers. Language models are often able to independently recognize and decode such designs thanks to these training. Strong encryption deprives the model of such a short path and forces you to refer to the code execution environment. The protective filter checks the original encrypted text, and this instruction appears later, already inside the working context of the agent.
Adversa AI tested a similar approach on the public version of Google Gemini. It was not possible to completely repeat the scenario of theft of Grok's correspondence, as the available Gemini environment Python could not turn to arbitrary external sites. At the same time, the cryptographic injection of the context allowed to bypass some of the security restrictions and receive answers that the service usually blocked. By August, the efficiency of the bypass has significantly decreased, which specialists associate with possible changes in filters, models or both components.
The researchers reported the xAI problem on June 3, 2026, directly and through the HackerOne Rewards Program. The company confirmed receipt of the report, but according to Adversa AI, did not report a time frame for the problem. Additional appeals were followed on 4 and 10 August. The audit on August 19 still allowed to reproduce the attack on Grok.com. Public information about the operation of the method against real users researchers do not lead, the finished working useload Adversa AI also decided not to publish.
Previously, there was a broader problem of indirect injections of industrialists: the risk is growing sharply when AI gets not only access to external content, but also the ability to run code, access the network and work with user data. Cryptographic Context Injection shows another weak part of the architecture: filtering of the input text is not enough if the malicious instruction may occur later as a result of code execution. Protection requires control of the origin of the data, restrictions on external requests and separate verification of actions before transmitting information outside the service.
