New Cryptographic Context Injection Attack Puts Grok Chat Data at Risk

A new attack technique, dubbed Cryptographic Context Injection, has been disclosed by Adversa AI, which claims it can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and conversation prompts to an attacker-controlled server. This can happen when a user asks the chatbot to summarize an ordinary web page.

## How the Attack Works The attack technique involves shipping the attacker's instructions as ciphertext, which is then decrypted by the Grok chatbot using its own Python code execution runtime. The decrypted instructions then direct the agent to resolve its private session context and embed it in a URL, which is opened to fetch additional context. This allows the attacker to extract sensitive user data without any visible warning or confirmation step.

The attack relies on the fact that strong encryption cannot be read by a content classifier, and therefore, the instructions reach the model's context as the output of code the model has just executed, rather than as fetched web content. According to Rony Utevsky, lead researcher at Adversa AI, this makes it difficult for the model to detect and prevent the attack.

## Comparison of Attack Techniques | Attack Technique | Target | Success Rate | | --- | --- | --- | | Cryptographic Context Injection | Grok 4.5 Fast | 40% | | Cryptographic Payload Injection | Gemini 3 Flash (Web) | Not reported |

## Mitigation and Prevention Adversa AI has advised teams running agents to take several steps to prevent such attacks, including quarantining untrusted content, gating irreversible and outbound actions, capturing per-session tool traces, alerting on the sequence of events, and making context provenance a procurement requirement. By taking these steps, teams can reduce the risk of their agents being exploited by attackers using the Cryptographic Context Injection technique.

The disclosure of this attack technique has raised concerns about the security of chatbots and the potential risks of data exfiltration. As the use of chatbots and AI-powered agents becomes more widespread, it is essential to ensure that they are designed and implemented with robust security measures to prevent such attacks. The fact that xAI's handling of prompt injection reports against Grok has drawn criticism in the past highlights the need for vendors to take security concerns seriously and provide timely and effective mitigations.