Security firm Adversa AI says it found a way to get xAI's Grok chatbot to leak a user's personal data by hiding encrypted instructions inside a web page. The Hacker News and SC Media also reported the findings.
The technique, which Adversa calls Cryptographic Context Injection, embeds AES-encrypted instructions and a decryption key in ordinary web content. Grok's input filter scans incoming content as plaintext and cannot read the ciphertext, so it passes the payload through unchanged; the model then decrypts the instructions inside its own trusted execution context and follows them as if they were legitimate, Adversa researcher Rony Utevsky said.
In a proof of concept, asking Grok to summarize a page containing the hidden payload caused it to send the user's name, approximate location, subscription tier and the full text of the ongoing conversation to an attacker-controlled server, appended to a URL, with no confirmation prompt or visible warning, according to Adversa. The firm said it reproduced the attack against Grok 4.5 Fast on grok.com on August 19, with a 40% success rate across 20 attempts.
Adversa said it reported the flaw to xAI in June through direct contact and the company's HackerOne bug bounty program, followed up again on August 4 and August 10, and received no response; as of publication, xAI has not shipped a fix, assigned a CVE or issued a public statement, according to Adversa and SC Media. Similar encryption-based bypasses have been demonstrated against Microsoft 365 Copilot and Google's Gemini, SC Media reported.
The underlying problem isn't specific to Grok: any safety filter that inspects content before a model decrypts or otherwise transforms it can be walked past the same way. Teams giving a model both web access and the ability to reach the network on its own should treat that combination as an exfiltration path until proven otherwise, not after a researcher demonstrates it.