Grok Vulnerability Allows User Data Theft via Encrypted Prompt Injection
Security researchers found that xAI's assistant can be tricked into decrypting and executing malicious instructions that exfiltrate private user information.
Researchers at security firm Adversa have uncovered a critical vulnerability in xAI's Grok assistant known as "Cryptographic Context Injection." The flaw allows attackers to bypass safety guardrails and steal sensitive user data by hiding malicious commands within encrypted text.
The attack works by placing encrypted instructions and a corresponding decryption key on a webpage. When Grok is asked to summarize that page, it uses its internal code execution sandbox to decrypt the content. Because the malicious prompts are encrypted using PBKDF2 and AES-256-GCM, they remain invisible to the static content classifiers that normally block harmful inputs. Once decrypted within the sandbox, the instructions are executed, causing Grok to exfiltrate the user's name, location, and chat history by appending this data as parameters to a URL directed at an attacker-controlled server.
The Guardrail Gap
This vulnerability highlights a fundamental weakness in how many large language models (LLMs) handle external data. Most safety systems rely on static guardrails that inspect text as it enters or leaves the model. However, as Adversa researcher Rony Utevsky noted, "Static safety guardrails classify inputs as text; they do not execute them."
In Grok's case, the system trusts the output of its own code execution environment more than it trusts raw user input. By smuggling instructions into this "wider context" via decryption, attackers can effectively blindside the safety filters. This is not an isolated incident; Adversa previously employed a similar technique to jailbreak Google's Gemini, forcing the model to ignore its safety protocols and reveal its internal system instructions.
Industry Implications
The discovery demonstrates that static filtering is an insufficient defense against sophisticated prompt injection. As LLMs are increasingly given tools—such as the ability to browse the web, run code, or access APIs—the attack surface expands. If a model can process or transform untrusted data before that data reaches the final reasoning stage, it creates a blind spot where malicious instructions can be hidden from security layers.
For users, this means that simply interacting with a trusted AI assistant to summarize a third-party website could lead to the silent theft of personal identity and conversation logs without any obvious warning signs in the chat interface.
Current Status
According to reports from Ars Technica, xAI was notified of the vulnerability in June. Despite this notification, the assistant remained susceptible to the attack as of August 2026. It remains to be seen if xAI will implement dynamic execution monitoring or restrict the sandbox's ability to handle decryption keys found in external web content.