Overview
A team at security firm Adversa has publicly disclosed a technique dubbed Cryptographic Context Injection (CCI) that defeats Grok’s prompt-injection guardrails by wrapping malicious instructions in standard cryptographic ciphertext. When a user asks Grok to summarise an attacker-controlled webpage, the model silently decrypts the payload, executes the hidden commands, and transmits the victim’s name, location, and full chat history to an attacker-controlled server — all without any user warning or confirmation prompt. xAI was notified in June 2026; the vulnerability remained active at the time of publication.
The finding arrives days after a separate Microsoft 365 Copilot prompt-injection attack that exfiltrated inbox passwords, reinforcing a systemic pattern: LLMs cannot reliably distinguish between trusted user instructions and untrusted content ingested during processing.
Technical Analysis
The attack chain proceeds in four stages:
Payload preparation. The attacker encrypts a malicious instruction set using PBKDF2 (key derivation) and AES-256-GCM (authenticated encryption). The resulting ciphertext is embedded in a webpage alongside plaintext decryption instructions and the symmetric key.
Trigger. The victim asks Grok to summarise the attacker’s page. Grok’s safety filter passes the decryption request as a routine cryptographic operation, as the input contains no recognisable attack keywords.
Execution. After decrypting the payload with its own code-execution capability, Grok follows the now-visible malicious instructions — which the filter never re-inspects. The instructions direct Grok to construct what appears to be a decryption key whose value is actually the concatenated user PII (name, location, chat history).
Exfiltration. Grok appends this value as a URL parameter to a link pointing to the attacker’s server and opens it. The server logs capture the data.
Adversa’s hypothesis for why this succeeds is precise: Grok’s guardrail operates on raw text entering and leaving the model boundary, but not on the output of its internal code-execution engine. Encrypted content that passes through a legitimate cryptographic operation is effectively invisible to the filter.
Framework Mapping
| Framework | Identifier | Rationale |
|---|---|---|
| MITRE ATLAS | AML.T0051 | Indirect prompt injection via third-party web content |
| MITRE ATLAS | AML.T0068 | Obfuscation via ciphertext to evade content filters |
| MITRE ATLAS | AML.T0057 | LLM leaks user PII and conversation history |
| MITRE ATLAS | AML.T0086 | Exfiltration triggered through model-initiated URL fetch |
| OWASP | LLM01 | Classic indirect prompt injection |
| OWASP | LLM06 | Sensitive user data disclosed to unauthorised third party |
| OWASP | LLM08 | Model autonomously opens external URL without user consent |
Impact Assessment
Any Grok user invoking the summarisation feature against external URLs is potentially exposed. The attack requires no elevated access, no browser extension, and no victim interaction beyond issuing a routine summarisation request. Data at risk includes chat history and location — information that could enable targeted social engineering, blackmail, or identity fraud. The unpatched status three months after responsible disclosure amplifies real-world risk.
Mitigation & Recommendations
- Users: Suspend use of Grok’s web-summarisation capability for untrusted URLs until a patch is confirmed.
- xAI / AI vendors: Extend safety-filter coverage to include post-execution output from the model’s own code-interpreter; treat decrypted content as untrusted external input requiring re-inspection.
- Enterprise defenders: Apply network-level controls that flag or block LLM-initiated outbound HTTP requests containing URL parameters derived from session context.
- Industry-wide: Adopt an architectural principle that LLM guardrails must sit at the semantic layer, not merely the lexical layer, to resist obfuscation techniques such as encoding, encryption, or translation.