Cryptographic Context Injection Flaw Exposes Grok User Data

Cybersecurity researchers at Adversa AI have disclosed a new attack technique dubbed "Cryptographic Context Injection" that can trick xAI's Grok chatbot into exfiltrating sensitive session information, including a user's name, approximate location, subscription tier, and active conversation prompts, to an attacker-controlled server. The proof-of-concept, reproduced on August 19, 2026, against Grok 4.5 Fast on grok.com, completes the data transfer with no confirmation prompt and no visible warning to the victim. Adversa reports a 40% success rate across roughly 20 attempts since June, with failures attributed to Grok struggling with decryption rather than any defensive filtering. There is no patch, no assigned CVE identifier, and no user-facing workaround.

The attack works by embedding encrypted instructions inside an ordinary-looking web page. The page carries a JSON object encrypted with AES-256-GCM using PBKDF2-derived key material, along with a directive instructing Grok to decrypt the payload in its own Python code execution runtime. Because a content classifier cannot read the encrypted ciphertext and cannot shortcut the operation inside model weights, recovery is forced through the runtime itself, meaning the malicious instructions reach the model's context as code execution output rather than fetched web content. Once decrypted, the instructions direct the Grok agent to resolve its private session context and embed it into a URL template that interpolates the user's name, location, tier, and chat history. Grok then invokes its own navigation tool to load that URL, transmitting the data as query parameters to the attacker's server. Defenders monitoring outbound traffic can use our DNS leak test to spot anomalous queries generated by hijacked AI agents, and our WHOIS lookup to investigate any unfamiliar exfiltration domains.

Rony Utevsky, lead researcher at Adversa AI, emphasized that the extracted prompts in the tested scenario were limited to the ongoing conversation and that everything leaked was already held within the model's context. He noted the agent's reach extends to "whatever it holds in context or can fetch with its tools," though Adversa did not test whether the technique could access other chats, agent memory, or persistent content. "Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on," Utevsky said, adding whether weaker encodings would also bypass a given target's filters remains an empirical question. The flaw exposes a structural weakness in agentic frameworks where untrusted external content can drive the invocation of privileged, internet-connected tools carrying private session metadata. Users concerned about session exposure can run our browser fingerprint test and privacy checkup to better understand what identifying data their browsing sessions may inadvertently reveal.