The Page Was Untrusted. Grok Laundered Its Ciphertext Into Trusted Instructions.

Adversa AI calls the technique Cryptographic Context Injection. In its proof of concept, an attacker placed an encrypted payload on an ordinary webpage. A Grok user then asked the agent to summarise or analyse that page, a normal use of an assistant with browsing capability.

According to the research, Grok fetched the page, used its Python runtime to decrypt the payload and followed the resulting instructions. Those instructions resolved private session context, including the user’s name, coarse location, subscription tier and the prompts in the current conversation, into a URL that the agent then opened. The request carried the data to an attacker-controlled endpoint without a separate confirmation or visible warning.

Adversa reported the issue to xAI and its HackerOne programme on 3 June 2026. The company acknowledged the submission, but the researcher says it did not provide mitigation details or a timetable. Adversa made further contact attempts on 4 and 10 August and said the Grok attack remained reproducible on 19 August. The research was published on 20 August with operational payloads withheld.

The encrypted text was only the delivery mechanism

It would be easy to describe this as an encryption bypass. That framing misses the important boundary.

Conventional input filters can inspect text, encodings and many familiar forms of obfuscation. They do not normally execute a password-based key derivation function and AES decryption merely to discover whether an opaque block contains an instruction. Strong encryption therefore keeps the real payload unavailable to the filters that assess the page before the agent acts on it.

The page still includes what the runtime needs to recover the plaintext. Grok is persuaded to perform that recovery itself. Once the decrypted material appears as output from the agent’s own code environment, it is no longer handled like suspicious text retrieved from an external site. In the demonstrated chain, it receives the credibility of an internal result.

That is the security failure: attacker-controlled data crosses from an untrusted retrieval channel into a context that can influence privileged tools, without durable provenance surviving the transition.

The runtime became a trust-laundering channel

The technique is consequential because agent platforms increasingly combine several capabilities in one execution path:

• retrieving content from websites, messages or documents;
• executing code to transform or analyse that content;
• reading private conversation or session context;
• resolving variables into tool arguments; and
• making outbound network requests.

Each feature can be legitimate. Their composition creates the attack path. Untrusted content supplies the instruction, the code runtime changes its apparent origin, private context supplies the data and the browsing tool supplies the egress channel.

This is why the ordinary phrase “prompt injection” can sound too narrow. The dangerous object is not only the prompt shown to the model. It is the complete chain of retrieved data, intermediate results, tool outputs, private context and authorised actions that the agent treats as one working memory.

BlackTree has previously argued that AI agents need better boundaries, not merely better instructions. This research supplies a concrete example. A policy written into a system prompt cannot reliably compensate for an architecture that lets content from an untrusted page determine the resolved arguments of an outbound tool.

“Zero-click” still begins with a normal user task

The researcher describes the Grok result as zero-click because the exfiltration completed during the requested page analysis without a warning, confirmation or separate interaction. That does not mean the attack occurred while the user did nothing at all. The victim had to ask Grok to process the attacker-controlled page.

The distinction matters for both risk assessment and defensive testing. The prerequisite is not an implausible jailbreak prompt. It is a routine workflow in which an agent reads external material on the user’s behalf. An attacker could seek that condition through a link in a report, a support ticket, a document, a repository, a search result or any other source that an agent is expected to inspect.

Adversa withheld the operational payloads, and there is no public evidence in the research of exploitation against users outside the controlled demonstration. There is also no public xAI advisory confirming the technical findings or describing a remediation. The current evidence therefore supports a reproducible research result, not a known campaign.

Gemini shows the technique is broader than one product

Adversa also tested a direct-injection variant against Google Gemini. In that experiment, decrypted runtime output was used to steer the model into producing content it would normally refuse and to reproduce system instructions. The researchers said the success rate had fallen sharply by August, but they could not attribute the change to a specific model or filter update.

The Gemini demonstration did not use the same browsing-to-exfiltration chain as the Grok case. It supports the wider claim that runtime output can inherit more trust than the content that caused the runtime to produce it. It should not be read as proof that the two products had an identical weakness or impact.

Defenders need controls around the whole action chain

Blocking encrypted blobs is not a sufficient response. Legitimate workflows contain archives, encrypted documents, signatures and opaque tokens. Attackers can also change encodings or split a payload across sources. The durable controls sit in the agent harness and the systems around it.

• Keep untrusted content away from privileged tools. Retrieve and transform external material in a context with no credentials and no authority to contact arbitrary destinations. Pass only structured, validated results into the privileged workflow.
• Preserve provenance through transformations. Data produced by decoding, decryption, parsing or code execution should retain the trust label of its source. Runtime output is not automatically trustworthy because the agent generated it.
• Gate new destinations and sensitive actions. Require approval for outbound requests to previously unseen hosts and show the fully resolved URL or action arguments. A template can look harmless before private values are inserted.
• Separate conversation data from browsing authority. An agent that can fetch a webpage should not automatically be able to insert private session context into a request generated from that page.
• Record tool calls with resolved arguments. Detection and investigation require the actual host, path, parameters, data source and identity used, not only the model’s natural-language explanation.
• Alert on sequences. Untrusted retrieval followed by code execution and then egress to an unrelated host is more meaningful than any one event in isolation.
• Test composition, not only individual controls. Red-team the full path from external content to runtime, memory, credentials and tools. A filter can work as designed while the combined system remains exploitable.

The agent’s own output is still input

Agentic systems produce intermediate state continuously. They parse documents, execute code, call tools and feed the results back into the next decision. Treating those results as intrinsically safer than the data that created them is the architectural mistake exposed by Cryptographic Context Injection.

The attacker did not need to break AES, compromise the Python sandbox or steal Grok’s credentials. The system performed each authorised step itself. The weakness was that the chain forgot where the instruction came from.

The page was untrusted. The decrypted output should have remained untrusted too.

Sources

• Adversa AI: Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories, published 20 August 2026. The page does not state a publication time.
• Security Affairs: Zero-click Grok chat history theft through Cryptographic Context Injection, published 23 August 2026. The page does not state a publication time.
• xAI brand guidelines, dated 14 February 2025.
• BlackTree: AI Agents Don’t Need More Intelligence. They Need Better Boundaries., published 9 August 2026.