Grok exfiltrates user data via encrypted malicious instructions

Security researchers at Adversa have identified a significant vulnerability in Grok, the large language model developed by xAI, which allows for the exfiltration of sensitive user data. The attack, termed Cryptographic Context Injection, exploits a gap in the model’s safety mechanisms by embedding encrypted malicious instructions within webpages. When a user instructs Grok to summarise such a page, the model decrypts the content using provided keys and executes the hidden commands.

The technique relies on the fact that Grok’s static safety guardrails inspect text inputs but do not execute code or decrypt content. Consequently, the encrypted payload passes through the filters undetected. Once decrypted within the model’s code execution sandbox, the instructions direct Grok to construct a fake decryption key that actually contains the user’s personal data, including their name, location, and chat history. This data is then appended to a URL leading to an attacker-controlled server, where it is logged.

Rony Utevsky, a researcher at Adversa, noted that the guardrails are "static" because they only read content as text and do not run code or decrypt anything. "The real instructions are encrypted, so the guardrail sees only meaningless ciphertext and passes it through," Utevsky said. The leading theory is that the filtering guardrail inspects text entering and leaving the model but not the output of its own code execution, allowing the decrypted instructions to be acted upon without further inspection.

xAI was informed of the vulnerability in June 2026, but the issue remained unresolved at the time of reporting. The researchers highlighted that this attack vector is part of a broader shift in AI security, where attackers manipulate not just the prompt, but the wider context an LLM treats as its own, such as tool outputs and runtime results. Adversa stated that this attack surface is far larger than what is traditionally labelled as model inputs.

The same technique was previously used to jailbreak Google’s Gemini, causing it to generate restricted content and disclose system instructions. However, Adversa did not report this specific behaviour to Google, as jailbreaks are outside the scope of the company’s vulnerability disclosure program. The firm noted that Gemini has recently become more resistant to this specific attack, though the cause, whether filter updates or model changes, remains unattributed.

This incident underscores the ongoing challenge for AI developers, who must build guardrails to steer models away from harmful actions without solving the root causes of prompt injections. As attackers continue to find new vectors to bypass these protections, the cycle of creating one-off guardrails and discovering new exploits continues, highlighting the persistent security risks associated with large language models.