# New Security Vulnerability in Grok and Gemini: Cryptographic Context Injection A novel attack technique bypasses AI safety measures using AES-encrypted payloads. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-08-23 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/2f5316bb-75e6-4da2-9da0-6e7f78206cca ## Discovery of New Attack Technique Adversa AI researcher Rony Utevsky developed a new attack technique called Cryptographic Context Injection. This method bypasses AI safety filters by embedding malicious instructions within AES-encrypted text. The technique was demonstrated live on xAI's Grok and Google's Gemini systems. The attack works by tricking the model into decrypting and executing the instructions within its own code execution runtime, making them appear as trusted commands. ## Data Theft in Grok A simple 'summarize this page' request in Grok triggers the decryption of an encrypted payload. The model decrypts the payload in its Python sandbox and executes hidden instructions. These instructions access the user's private data including name, location, subscription plan, and full chat history. The data is then automatically inserted into a URL that opens without any user warning or interaction required. ## Technical Distinctions Unlike previous cipher-based attacks, decryption occurs within the model's own execution environment. The attacker sends ciphertext along with key material and decryption instructions. While security scanners can see all page content, recovering plaintext requires running PBKDF2 and AES-256-GCM algorithms - something no content classifier does during inspection. This creates a blind spot that the attack exploits. ## Security Breach in Gemini The same technique works differently in Gemini. A prompt asks Gemini to run a Python script that decrypts data. The decrypted output contains fake Python error messages with hidden instructions designed to bypass Gemini's safety rules. Since Gemini treats sandbox output as trusted context, these instructions can influence model behavior. Adversa used this to make Gemini generate prohibited content and reveal system instructions. ## System Design Flaws Adversa traces the root cause to Grok's agentic framework design. The system allows instructions from untrusted external pages to trigger privileged, internet-connected tools. Private session metadata and conversation history can be incorporated into outbound call inputs without any egress boundary or consent gate. This mirrors SQL injection vulnerabilities where systems can't distinguish trusted state from attacker-supplied data. ## Defense Recommendations Adversa's defense guidance emphasizes that fixes aren't needed at the model layer. All necessary controls exist in the agent's harness. Untrusted content should be processed in tool-free, credential-free contexts, returning only structured data to privileged contexts. Outbound network calls and external writes should require explicit confirmation with fully resolved arguments visible beforehand for approval. ## Detection Mechanisms Detection systems should focus on sequences rather than individual payloads: untrusted content enters context, code executes, and the agent contacts hosts outside its normal dependency graph. This chain represents the true signal. Per-session tool traces with resolved arguments must be logged, as forensic analysis and detection are impossible without them. ## Industry Impact and Implications This attack reveals fundamental weaknesses in AI security design, particularly in agentic frameworks' inability to distinguish between trusted and untrusted data flows. AI developers must reevaluate sandbox security boundaries and implement more layered consent mechanisms for user data protection. The vulnerability underscores the need for robust forensic capabilities in AI systems handling sensitive information. ## Sources covering this story - https://securityaffairs.com/197717/hacking/zero-click-grok-chat-history-theft-adversa-ai-demonstrates-cryptographic-context-injection.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._