Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini
Researchers at Adversa AI have identified a novel attack technique dubbed Cryptographic Context Injection that successfully circumvents safety guardrails in major AI platforms, including xAI's Grok and Google's Gemini. The team reported their findings to xAI on June 3, 2026, and attempted to coordinate disclosure on August 4 and August 10, but received no response. They could not disclose to Google because jailbreaks fall outside the scope of Google's vulnerability disclosure program. Despite Google's restrictions, the attack success rate against Gemini had declined by August, though the technique remains a serious concern for enterprise deployments of agentic AI.
The attack exploits a fundamental weakness in how safety guardrails operate. They classify prompt text without executing it, which means they cannot parse ciphertext into anything harmful and consequently allow its progress. The encrypted payload—containing a malicious instruction along with its decryption method—is executed within the model's code execution sandbox. Once decrypted inside the trusted execution context, the plaintext prompt is reconstructed and processed without being flagged as harmful. According to the researchers, "the attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt." The attack can be delivered directly through a chat interface or indirectly via a watering hole, where a web page hosts an encrypted JSON object and decryption instructions for an AI agent to process.
In the Grok example targeting xAI's agentic browsing framework, the technique enables zero-click data exfiltration through social engineering. A target is persuaded to visit a weaponized web page containing an encrypted JSON object and instructions to decrypt it using the agent's Python runtime. The decrypted prompt instructs the agent to resolve its private session context and embed the data into a URL, which is then autonomously loaded—transmitting user data, including private session metadata and conversation history, to the attacker. The researchers warn that the xAI framework lets instructions and data parsed from untrusted external pages drive the invocation of privileged, internet-connected tools without user confirmation or visible warning. In agentic scenarios, the decrypted instructions could instigate misuse of any tool available to the model, exfiltrate data through request parameters, or produce undesired results re-encrypted to smuggle past output guardrails.
Security teams and individuals concerned about session exposure should audit their digital footprint using our DNS leak test and browser fingerprint test to identify vectors through which session metadata could be harvested by malicious agentic workflows. Monitoring personal account exposure with our email breach checker can also help detect whether credentials or identifiers tied to AI platforms have already been compromised.