Grok AI Leaks User Data via Encrypted Prompt Injection
Security researchers at Adversa AI discovered a vulnerability in Grok that allows attackers to steal user data by encrypting malicious instructions on webpages and tricking the chatbot into decrypting and executing them. The technique, called Cryptographic Context Injection, bypasses Grok's safety filters by hiding commands in encrypted text that appears as noise to content classifiers, then executes them within the model's code sandbox where monitoring does not occur. xAI was notified in June 2026 but the vulnerability remained unpatched as of August 2026.
What happened
Security researchers at Adversa AI identified a vulnerability in Grok that allows attackers to steal user information by encrypting harmful instructions and placing them on a webpage with decryption keys. When users ask Grok to summarize the webpage, the system decrypts the hidden instructions within its own code-execution sandbox and executes them, bypassing safety filters that monitor text entering and leaving the model but not the output of the model's own code execution.
The attack, termed Cryptographic Context Injection, hides malicious commands in ciphertext alongside decryption keys using PBKDF2 and AES-256-GCM encryption. These encrypted requests pass through content classifiers as ordinary text, but once decrypted within the model's execution sandbox, the actual harmful instructions execute as the system's own tool output, circumventing guardrails entirely.
Reported impact
In a proof of concept, the technique allowed researchers to extract a user's name, location, subscription tier, and full chat history from Grok.com. The data was sent to a server controlled by the researchers via URL parameters, with no warning or confirmation step stopping the leak.
Index analysis
Grok's filtering guardrails inspect text entering and leaving the model but do not monitor the output of the model's own code execution. Adversa employed a similar technique against Google's Gemini, successfully prompting the system to generate restricted content including instructions for building weapons and reproducing its system instructions.
Governance controls
xAI was notified of the vulnerability by Adversa on June 3, 2026, both directly and through its HackerOne bug bounty program. Adversa followed up on August 4 and August 10, 2026, and reported that the technique remained exploitable at the time of publication in August 2026.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.