Encrypted Prompt-Injection Attack Raises Data Privacy Concerns for xAI’s Grok

Security researchers have demonstrated a prompt-injection technique that may allow a malicious web page to trick xAI’s Grok chatbot into exposing information from an active conversation.

AI security company Adversa AI calls the technique Cryptographic Context Injection. It uses encrypted instructions to avoid conventional content inspection before directing an AI agent to perform unintended actions.

In a proof-of-concept involving Grok 4.5 Fast on grok.com, researchers said a user only needed to ask the chatbot to summarize a specially prepared web page. Grok could then decrypt hidden instructions and potentially send information from the current session to an attacker-controlled server.

The exposed data reportedly included the user’s name, approximate location, subscription tier and prompts from the active conversation.

How Cryptographic Context Injection Works

The attack is a concealed form of indirect prompt injection. Instead of placing malicious instructions on a webpage as readable text, the attacker hides them inside encrypted data and provides the information needed to decrypt it.

According to Adversa, Grok used its Python environment to recover the instructions using PBKDF2 and AES-256-GCM. A security filter may initially see only ciphertext, while the actual instructions appear later after the AI decrypts them.

The technique does not exploit encryption itself. Instead, encryption is used to hide instructions from earlier inspection.

In the demonstration, the decrypted payload allegedly directed Grok to place session information into an external URL and access it using its navigation tools, creating a path for data exfiltration.

No exploitation in the wild has been publicly reported. The company said the technique succeeded in about 40% of 20 attempts since June.

A Wider AI Security Concern

The research highlights a broader challenge as AI assistants gain access to browsers, code execution and external tools.

Prompt filtering alone may not be enough when malicious instructions can appear only after content has been processed. Stronger safeguards may require isolating untrusted content, restricting outbound actions and monitoring how information moves between tools.

The larger issue extends beyond Grok. As AI agents gain more autonomy, security depends not only on what a model can generate, but also what it is allowed to access and send elsewhere.