Zero-Click Grok Chat History Theft Adversa AI Demonstrates Cryptographic Context Injection
Zero-Click Grok Chat History Theft 🚨
Adversa AI researcher Rony Utevsky has devised a groundbreaking attack technique known as Cryptographic Context Injection. This method bypasses AI safety filters by sending instructions as AES-encrypted ciphertext, tricking the model into decrypting them within its own code execution runtime. The technique was demonstrated against xAI’s Grok and Google’s Gemini.
According to the report published by Adversa AI, “Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.”
The Grok Case 🔍
The Grok case is particularly alarming. A user can ask Grok to summarize a webpage containing an encrypted payload. Grok decrypts this payload in its Python sandbox and follows the hidden instructions, accessing the user’s private session data, including their name, location, subscription plan, and full chat history. This sensitive information is then placed into a URL that Grok opens automatically, without any warning to the user. Adversa confirmed that the attack was still reproducible as of August 19, 2026.
Technical Distinction ⚙️
The key technical distinction from earlier cipher-based prompt injection work lies in what occurs during decryption. Static safety guardrails classify inputs as text and do not execute them. An attacker can ship ciphertext along with the key material and an instruction to decrypt it, causing the model to run that decryption inside its own code execution sandbox. Recovering the plaintext requires running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. The runtime decrypts the payload, and the attacker’s instructions appear as the output of code the model just executed, not as untrusted external content.
The Gemini Case 🔥
The Gemini case employs the same basic trick to generate detailed instructions for building an incendiary device and also exposes Gemini’s system instructions. Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still functional shortly before publication. The Gemini issue was not formally reported due to Google’s bug bounty excluding jailbreaks.
Recommendations for Defenders 🛡️
Adversa’s guidance indicates that nothing about this attack necessitates a fix at the model layer. Untrusted content should be processed in a context devoid of tools and credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, and the agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob.
For further details, you can read the complete article here: Read full article