Adversa AI reports encrypted prompt-injection path for Grok chat data
Adversa AI has disclosed what it calls a Cryptographic Context Injection technique that it says can make xAI’s Grok web chat disclose a user’s name, approximate location, subscription tier and prompts from an active conversation to an attacker-controlled server. The company tested grok.com running Grok 4.5 Fast and said it reproduced the attack once on August 19, 2026.
Adversa said it attempted the technique 20 times since June and saw a 40% success rate. It did not report exploitation in the wild, a CVE identifier, a patch or a user-facing workaround. xAI acknowledged the June 3 disclosure through its HackerOne programme, Adversa said, but had not published an advisory or mitigation timeline as of August 20.
Encrypted payload becomes an instruction
The proof of concept places an encrypted JSON object, key material and decryption instructions on an ordinary web page. When a user asks Grok to summarise that page, the chatbot is directed to run PBKDF2 and AES-256-GCM decryption in its Python code-execution runtime.
That design matters because a content classifier inspecting the page does not decrypt the ciphertext. In Adversa’s account, the recovered text enters the model context as output from code the model has executed rather than as visible web content. The reported failures were attributed to Grok struggling with decryption, not to the prompt or response being flagged.
The decrypted payload tells the agent to resolve private session context and insert it into a URL presented as a request for additional context. One purported decryption key is instead a template string containing the user name, location, tier and chat history. Grok then uses its navigation tool to load the URL, exposing that data through query parameters. Adversa said the tested extraction was limited to the ongoing conversation and did not test access to other chats, agent memory or other material.
Controls belong around the agent
The finding adds to concerns about agent systems that combine untrusted web content with internet-connected tools, a pattern also visible in growing AI-agent incident chains as organisations confront growing AI-agent incident chains. Adversa argues that the relevant controls sit in the agent harness: identity, reachable resources, writable targets and the ability to replay actions.
Its recommendations include quarantining untrusted content in a context without tools or credentials, returning only structured data to a privileged context, and requiring confirmation for new network destinations and other irreversible outbound actions. Teams should also record per-session tool traces with resolved arguments and treat an opaque blob paired with decryption instructions as a review signal rather than relying on a single-payload blocklist.
For businesses deploying browser-connected assistants, the practical implication is to separate untrusted content from privileged tools, enforce explicit egress controls and retain tool-level evidence before allowing agents to act on decoded external instructions.