Researchers Encrypted the Attack So Grok Could Not Read It. Grok Decrypted It Itself
Adversa AI hid instructions in a webpage using AES-256. Grok's own code sandbox unlocked them and then leaked the user's chat history. Reported in June, still unpatched.
Security researchers at Adversa AI have published an attack that turns an ordinary request into a data leak. Ask xAI’s Grok to summarise a webpage, and if that page carries a specially prepared payload, Grok can end up sending your name, approximate location, subscription tier and current conversation history to a server you have never heard of. No click required.
The clever part is how the payload gets past the defences. Chatbots that browse the web have filters that look for suspicious instructions hidden in page text, the classic prompt injection. Adversa’s answer was to make the instructions unreadable: the payload is encrypted with AES-256-GCM, a standard strong cipher, and the page also supplies the key. The safety filters see gibberish and let it through. Then Grok, which has a built-in Python sandbox for running code, dutifully decrypts the blob. What comes out is plaintext produced inside its own execution environment, and the model treats it as trusted internal context rather than untrusted content from a stranger’s website. The researchers call it Cryptographic Context Injection.
Across roughly 20 attempts since June the reported success rate was about 40 percent, with the failures caused by decryption going wrong rather than by any defence catching it. Adversa reported the flaw to xAI through its HackerOne programme on 3 June 2026, followed up on 4 August and 10 August, and says it has had no response. As of 19 August there was no patch and no CVE. The same writeup shows a related demonstration against Google’s Gemini in Deep Thinking mode.
The underlying problem is structural and it is not unique to Grok. Every model that both browses the web and runs code has the same shape: content arrives from an untrusted source, and somewhere downstream the system stops treating it as untrusted. Filters that scan incoming text for bad instructions only work if the instructions are visible at the moment of scanning. Anything that reconstitutes text later, whether by decryption, decoding or assembling it from fragments, walks straight past. This is the same class of failure behind the Copilot flaw we covered on 20 August, where one link chained a URL parameter, a fetch and persistent memory into a one-click data theft that took Microsoft eight months to fix. Prompt injection is not a bug that gets patched once. It is a property of systems that mix instructions and data in the same channel, and it will keep resurfacing in new clothes.
What this means for you: be careful what you ask a browsing assistant to read while a sensitive conversation is open in the same session. The exposure here is your current chat context, so the practical defence is separation: start a fresh conversation before pointing an assistant at an unfamiliar page, and do not paste passwords, contracts or personal data into a session you also use for web summarising. The same caution applies to any agent with browsing plus code execution, not just Grok. And if you are evaluating AI tools for a company, a vendor going eleven weeks without answering a HackerOne report is itself a data point.
Sources
Source: https://thehackernews.com/2026/08/new-cryptographic-context-injection.html
The Same Model Scored 30 Percent Alone and 100 Percent Inside Nvidia's Agent System
Nvidia's AVO cleared all 183 levels of ARC-AGI-3 using Claude Opus 5, a model that scores about 30 percent on its own. The interesting part is not the score, it is what changed.
