A researcher at security firm Adversa has demonstrated how xAI's Grok can be forced to leak user chats and personal information by embedding malicious commands in encrypted form, bypassing the model's security filters.
The attack, called "Cryptographic Context Injection," exploits a fundamental weakness in how large language models handle input from untrusted sources. Rony Utevsky's method encrypts harmful instructions on a webpage alongside the decryption key in plaintext. When a user asks Grok to summarize the page, the model decrypts and executes the hidden commands without warning.
The decrypted instructions construct a fake decryption key that actually contains sensitive user data—name, location, chat history. Grok then incorporates this data as a URL parameter that logs the information to an attacker's server when accessed.
xAI received notification of the vulnerability in June but did not fix it. Testing on Aug. 19 confirmed Grok remained vulnerable.
The flaw mirrors a separate attack disclosed this week against Microsoft 365 Copilot for enterprise, which was tricked into exfiltrating a password from a user's inbox. Both incidents reveal the same architectural problem: LLMs cannot reliably distinguish between untrusted external content and direct user commands.
Adversa's analysis suggests Grok's filtering guardrail inspects text input and output but skips the results of the model's own code execution. Instructions to using standards like PBKDF2 and AES-256-GCM pass through as routine requests, since the classifier cannot determine their intent without decryption.
This reflects a broader constraint in AI security. Developers cannot eliminate prompt injection—the technique ranks as the most severe vulnerability class for LLMs—so they rely instead on guardrails to steer models away from harmful actions. Adversa characterizes this as building a protective rail around a dangerous curve rather than engineering a safer curve design.
