Security Researchers Discover Cryptographic Prompt Injection Vulnerability in Grok

Security researchers at Adversa AI have identified a novel vulnerability in xAI's Grok web chat agent called cryptographic context injection. This technique allows attackers to bypass AI guardrails by placing encrypted malicious instructions and a decryption key on a web page. While standard input filters cannot read the encrypted text, the AI model uses its code execution sandbox to decrypt the instructions and then carries them out. In a proof of concept demo, the attack was used to exfiltrate a victim's chat history, including their name, coarse location, subscription tier, and full conversation prompts, by appending them to a URL.

Lead researcher Rony Utevsky reported that xAI was informed of the vulnerability on June 3, 2026, through direct contact and the HackerOne bug bounty program. Although xAI acknowledged the report, it did not provide a mitigation timeline, and the technique reportedly still worked on Grok.com as of August 19. SpaceX, which acquired xAI earlier this year, did not respond to requests for comment.

Adversa also tested the method on Google's Gemini. While Gemini's lack of external website access for Python prevented the same data exfiltration scenario seen with Grok, researchers were able to use the technique to bypass safety filters and generate instructions for building an incendiary weapon. Google was not informed of the attack because the company considers jailbreaks to be out of scope for its vulnerability disclosure program. Utevsky noted that the success rate against Gemini declined significantly by August, which may be due to model version changes or filter updates.