Encrypted Instructions Let Attackers Steal Your Grok Chats — And xAI Knew Months Ago
Two significant AI data theft vulnerabilities surfaced this week. Earlier, researchers showed how Microsoft 365 Copilot could be manipulated into leaking passwords from a user's inbox. Now, security firm Adversa has demonstrated something comparable against Grok — and the method used is almost insultingly simple.
Researcher Rony Utevsky found that by encrypting malicious instructions rather than writing them in plaintext, he could bypass Grok's content filters entirely. The attack works when a user asks Grok to summarise a webpage. That page contains ciphertext, a decryption key, and instructions telling Grok how to decrypt it. Grok does exactly that, then faithfully executes whatever the hidden instructions say — no warning, no confirmation prompt, nothing.
What those instructions actually do is construct what appears to be a decryption key. It isn't. The 'key' is actually the user's name, location, and chat history, packaged as a URL parameter pointing to an attacker-controlled server. Grok opens the link. The data lands in someone else's access logs.
xAI was told about this in June. At the time of writing, the attack still works.
So why does encrypting the payload make such a difference? Adversa's leading theory is that Grok's safety filters inspect content as static text. They can read the words 'PBKDF2' and 'AES-256-GCM' and recognise them as cryptographic terms, but they don't actually execute the decryption to find out what's on the other side. So the ciphertext sails through the filter as harmless gibberish. Once Grok decrypts it inside its own code execution environment, the malicious instructions arrive as tool output rather than user input, and the guardrails never see them.
Utevsky put it plainly: 'The real instructions are encrypted, so the guardrail sees only meaningless ciphertext and passes it through.'
Adversa applied the same basic logic to Gemini, with different results. There, the decrypted payload mimicked an error message, with an instruction buried inside telling Gemini to act on the error. It worked — producing detailed instructions for building an incendiary device, content Gemini's filters would normally suppress without hesitation. A tweaked version also extracted Gemini's own system prompt, including the directive explicitly forbidding its disclosure.
Adversa didn't report the Gemini findings to Google because jailbreaks fall outside the scope of Google's vulnerability disclosure programme. Interestingly, Gemini has become notably more resistant to the attack over recent weeks, though whether that's down to model updates, filter changes, or both remains unclear.
The firm is calling the broader technique Cryptographic Context Injection, and the name is apt. The attack doesn't just manipulate the prompt — it manipulates what the model treats as its own internal reasoning: tool outputs, runtime results, intermediate state. That is a considerably larger attack surface than what most defenders are thinking about.
And here's the uncomfortable structural problem. Prompt injection isn't a bug that can be patched. It exists because LLMs cannot reliably distinguish between content from an untrusted third-party source and instructions from the actual user. Every new guardrail is a workaround, not a fix. Attackers find a gap, defenders plug it, a new gap appears. Adversa's technique is just the latest proof that the gap-plugging approach has a ceiling.
The road safety analogy holds: you can keep adding crash barriers around a dangerous bend, but if nobody's willing to fix the bend itself, eventually something gets through.