Simply asking xAI’s Grok chatbot to summarize a webpage can hand over a user’s identity and conversation, Adversa AI warns. The firm’s proof of concept shows the model forwarding a person’s name, approximate location, subscription tier, and current prompts to an attacker-controlled server, with no confirmation step and nothing visible on screen.
Dubbed Cryptographic Context Injection, the trick delivers instructions as ciphertext rather than plaintext. Grok itself performs the decryption: the page ships an encrypted JSON payload alongside key material and an instruction to unlock it, which the model executes in its Python runtime. Because recovery needs PBKDF2 and AES-256-GCM, a content classifier cannot read the payload at inspection time; the malicious commands enter the model’s context as output of code it has just executed.
Adversa tested the attack against Grok 4.5 Fast on grok.com and reproduced it once on August 19. Across 20 attempts since June it reported a 40% success rate, with failures tied to Grok struggling with decryption rather than safety filters. No patch exists, no CVE has been assigned, and there is no user-facing workaround. Adversa reports no exploitation in the wild.
The research underscores a growing gap: classifiers judge visible text, while encryption hides intent until a model’s own runtime reveals it. Until vendors harden execution environments, users should treat page-summarization prompts as a data-leak risk.
