"Cryptographic Context Injection" Hides Prompts Inside AES Ciphertext to Steal Grok Chat Histories

The Grok web chat at grok.com running Grok 4.5 Fast, with the guardrail bypass also reproduced against Google Gemini

Adversa AI disclosed a technique it calls Cryptographic Context Injection, in which the malicious instruction is delivered as AES-encrypted text that input guardrails cannot classify because ciphertext parses to nothing harmful. The model is then persuaded to decrypt the payload inside its own context and treat the plaintext as its own reasoning. In the proof of concept the payload instructs Grok to assemble a "decryption key" that is in fact a template populated with the user's name, location, subscription tier, and conversation prompts, then to open an attacker-controlled site to "fetch additional context" with that data as URL parameters. The transfer completed with no confirmation step and no visible warning. The same encryption trick works in the other direction, letting a model re-encrypt disallowed output to slip past output filters. Adversa attempted the attack 20 times since June with a roughly 40% success rate and reproduced it on August 19, 2026. It reported to xAI on June 3 and tried to coordinate disclosure on August 4 and August 10 without response; there is no patch, no CVE, and no user-facing workaround. Google was not notified because jailbreaks fall outside its disclosure program, though the success rate against Gemini had declined by August. No in-the-wild exploitation is reported

Guardrails inspect prompt text without executing it, so they cannot see through encryption, while the model happily performs the decryption that turns opaque bytes into instructions inside the trusted context. Content-layer filtering placed on one side of a transformation the model itself can perform