Researchers have discovered a technique called "Cryptographic Context Injection," in which malicious instructions are encrypted to bypass AI safety guardrails, causing models like Grok and Gemini to exfiltrate sensitive user data such as names, locations, and chat histories. The attack works because static safety filters scan content as plain text but cannot execute or decrypt code, meaning the harmful instructions only become readable after the model processes them internally — outside the guardrail's view. The findings highlight a fundamental and ongoing weakness in LLM security, as defenders are forced to build reactive, piecemeal guardrails rather than addressing the root vulnerability of prompt injection.
