Cryptographic Context Injection
A prompt injection attack that hides its instructions behind encryption so filters see only gibberish, then lets the model decrypt them itself.
Ordinary prompt injection hides instructions in a webpage and hopes the model obeys them. Defences catch a good share of it by scanning incoming text for anything that looks like a command. Cryptographic Context Injection sidesteps that scan entirely: the instructions are encrypted, so the filter reads meaningless characters and waves them through, and the page also hands over the key.
The trap springs when the model has a code sandbox. Asked to make sense of the blob, it decrypts it, and the plaintext that comes out was produced inside the model’s own workspace rather than arriving from a stranger’s website. Systems that classify content by where it came from now treat it as trusted. Named by Adversa AI in August 2026, it is a good illustration of why prompt injection keeps returning in new forms.