Grok Data Exfiltration via Cryptographic Context Injection
Researchers at Adversa have demonstrated a novel prompt injection bypass against Grok, xAI's LLM, in which malicious instructions are encrypted using PBKDF2 and AES-256-GCM before being embedded in attacker-controlled web content. Because Grok's safety filters inspect plaintext input and output but not the results of its own code execution, the decrypted instructions execute without warning, causing the model to exfiltrate the user's name, location, and chat history to an attacker-controlled server. The vulnerability was disclosed to xAI in June 2026 but remained unpatched at time of publication, underscoring the systemic difficulty of defending LLMs against prompt injection at the model level.
