Grok Will Hand Your Chat History to a Web Page You Asked It to Summarize. xAI Has Known Since June 3.

On August 20, Adversa AI published a technique they call Cryptographic Context Injection. Against xAI's Grok web chat, an ordinary "summarize this page" request causes the agent to package up your name, your coarse location, your subscription tier, and every prompt you have sent in that conversation, stuff them into a URL parameter, and open it. No click. No warning. They reported it to xAI on June 3, 2026, and to xAI's HackerOne program the same day. They could still reproduce it on August 19.

If you are building anything that lets a model read a web page and then call a tool, this is your bug, not xAI's.

Encryption is the whole trick

Prompt injection defenses have gotten meaningfully better at the classic form: a bare instruction hidden in fetched text, sitting there in plaintext for a classifier to catch. This works around that in a way I find genuinely clever.

The attacker's page carries an AES-256-GCM ciphertext under a PBKDF2-derived key, with the key material sitting right next to it, plus an instruction to decrypt. A content classifier inspecting that page sees an opaque blob. It cannot read the instructions because reading them requires running PBKDF2 and AES, and classifiers score text, they do not execute it.

This is the part that separates it from earlier cipher-based jailbreaks. CipherChat and CodeChameleon leaned on weak, reversible transforms (substitution ciphers, XOR, base64, reordering) that a model can decode natively, in its own weights, no interpreter needed. Strong encryption has no in-weights shortcut. There is no way to recover the plaintext except through the code execution runtime, which means the attack is forced down exactly the channel where the model stops treating content as untrusted.

Because when the sandbox returns the decrypted plaintext, the model treats it as the output of code it just ran. Not as fetched external content. As its own internal state.

Adversa's framing is that the runtime launders attacker data into trusted instructions, and the closest classical analogy is SQL injection: a system that cannot tell its own query from attacker-supplied data flowing through the same channel. I think that comparison is exactly right and I would go further. We spent twenty years learning that "sanitize the input" loses to "separate the channels," and the agent ecosystem is currently rediscovering that lesson from scratch.

What actually happens in the Grok chain

The mechanics are worth walking through because the disguise is the interesting bit.

The decrypted instructions tell the agent to build an additional "decryption key." That key is not key material. Its value is a template string that interpolates the user's private session context: name, location, tier, conversation history. The model resolves the template, then uses the resulting string as a URL parameter, and invokes its privileged navigation tool to open that URL "to fetch additional context."

Read that again. The exfiltration payload is disguised as a cryptographic operation, in a chain where the model has already been primed to perform cryptographic operations. The one suspicious step, "put user data in a URL and open it," arrives wearing the costume of the thing the model is already legitimately doing.

Adversa's assessment of the harness is that instructions parsed from an untrusted page can drive a privileged internet-connected tool, private session metadata can be resolved into that tool's arguments, and there is no effective egress boundary, no consent gate, and no provenance separation they could observe on that path.

They also demonstrated the same technique against Gemini, where the payload decrypts into a fake Python traceback that carries a fabricated safety-policy-deactivation callback. Different target, different goal (content policy bypass rather than exfiltration), same laundering mechanism. Adversa says their success rate against Gemini dropped sharply over the summer and they cannot attribute the change to filter updates versus model version changes.

The disclosure timeline is the part I would be angry about

June 3, 2026: reported to xAI and to their HackerOne program.

xAI acknowledged the report. No specifics, no mitigation timeline. Adversa made further attempts to coordinate on August 4 and August 10 and got no response. They published on August 20, withholding operational payloads, with the vulnerability still live.

That is roughly eleven weeks on a zero-click data exfiltration bug in a shipped consumer product, with the reporter doing the coordination work and getting silence back. I do not know what xAI's internal triage looks like and I am not going to pretend I do. But from the outside, the observable facts are: reported, acknowledged, unfixed, three unanswered follow-ups.

If you are a SuperGrok user asking it to summarize pages, that timeline is the practical information in this post. The conversation history is in scope, not just the current prompt.

What this means if you are building an agent

Here is where I think most of us are quietly exposed. I have built the browsing-agent shape more than once: fetch a page, summarize it, then let the model call a tool based on what it read. It is maybe forty lines of glue. It is also the exact topology in this report.

And the preconditions get worse for the agents solo operators actually build. Adversa makes this point directly: for a coding agent or an ops agent, code execution is not an exception path, it is the product. Outbound network calls are routine, not anomalous. And the credentials in reach are repository write access and cloud tokens, not a session's metadata.

The fix is not at the model layer. Every control that bounds this sits in the harness:

Quarantine untrusted content in a context with no tools and no credentials. Summarizing a fetched page and holding repo write access should never be the same context. The quarantined context returns structured data to the privileged one; it does not get to act.

Gate outbound and irreversible actions on resolved arguments. Not the template, the resolved string. The Grok attack is invisible if you are reviewing a template and obvious if you are looking at the URL with the user's chat history already interpolated into it.

Log per-session tool traces with resolved arguments. Without them you have no forensics and cannot answer what the agent read before it acted.

Alert on the sequence, not the payload. Untrusted content enters the context, then code runs, then the agent contacts a host outside its dependency graph. That chain is the signal. An encrypted blob plus a decrypt instruction is a review flag, never a blocking filter.

What I'd actually do

If you run a browsing or coding agent with any real credential in reach, do the egress check this week. Not the full quarantine architecture, just this: can your agent make an outbound request to a host you have never seen before, with arguments derived from something it fetched, without a human seeing the resolved call?

If yes, you have the bug. An allowlist of egress destinations is a couple of hours of work and it converts this entire attack class from "silent exfiltration" into "failed request in a log." Destination-based control is the thing that fails closed here, because the payload still has to call somewhere.

If you are a Grok user, treat "summarize this page" on an untrusted URL as pasting your conversation into that page's guest book until xAI says otherwise. That is not hyperbole, it is a description of the reproduced behavior as of August 19.

Where I could be wrong

The attack needs the model to cooperate. It can decline to run the code, and Adversa is explicit that success rates vary by target and shift over time, which is precisely what happened with Gemini over the summer. So this is not a deterministic exploit, it is a technique with a hit rate, and that hit rate can quietly go to near-zero after a model update without anyone announcing it.

I would also push back on one implication people will draw from this. It is tempting to conclude the encryption is load-bearing, and Adversa themselves note that whether a weaker encoding would also bypass a given target's filters is an open empirical question. The durable insight is not "AES beats guardrails." It is that tool output and runtime results are context the model treats as its own, and that surface is much larger than what anyone means when they say "model input." Encryption is one way to force a payload down that channel. It will not be the last one.

Author

Lukas

@lukcombinator

Sources

• Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories
• New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
• Grok chat duped into swallowing injected instructions
• Researchers hid an attack inside AES encryption. The AI model cracked it open willingly.