Grok chatbot vulnerable to data theft via cryptographic context injection

Security researchers at Adversa AI have identified a critical vulnerability in xAI’s Grok chatbot, dubbed ‘cryptographic context injection’. The flaw allows attackers to exfiltrate sensitive user data by hiding malicious instructions within encrypted text on webpages.

When a user asks Grok to summarize or analyze a webpage containing this payload, the chatbot fetches the page and decrypts the instructions within its own Python code sandbox. Because the instructions are encrypted (using AES-256-GCM), they bypass the model’s standard safety filters, which typically only scan readable text. Once decrypted, the instructions command the model to package the user’s name, approximate location, subscription tier, and entire conversation history into a URL, which is then sent to an attacker’s server.

Adversa AI reported the vulnerability to xAI on June 3, 2026, but as of August 19, no patch has been released and the exploit remains reproducible. The technique highlights a growing attack surface where hackers manipulate the wider context an LLM treats as trusted, such as tool outputs and runtime results, rather than just the direct prompt.