Researchers Demo Encrypted Payload Attack That Tricks Grok Into Leaking User Data

Cybersecurity firm Adversa AI has disclosed a novel attack technique called Cryptographic Context Injection, demonstrated against xAI's Grok and a variant against Gemini. The method embeds an encrypted malicious payload on a webpage, which Grok's own code execution runtime decrypts during normal processing, keeping it invisible to content classifiers until it is too late. Once decrypted inside the execution environment, the instructions direct Grok to use its legitimate navigation tool to send sensitive user data — including name, location, subscription tier, and chat history — to an attacker-controlled URL. The attack requires no malware or traditional exploit; it exploits the gap between when content is scanned and when malicious instructions actually come into existence as readable text. Researchers note this undermines standard prompt-injection defenses, which assume adversarial content is visible somewhere along the request path.