xAI Grok chatbot vulnerable to data theft via cryptographic injection

Security researchers at Adversa AI have disclosed a zero-click vulnerability in xAI’s Grok chatbot, termed ‘Cryptographic Context Injection’ (CCI). The technique allows attackers to steal sensitive user data by hosting malicious, encrypted payloads on webpages that the chatbot is asked to summarize.

The attack bypasses standard security filters by using AES-256-GCM and PBKDF2 encryption. Because content classifiers cannot inspect the encrypted blobs, the malicious instructions remain hidden until Grok executes decryption logic within its own Python code execution runtime. Once decrypted, the instructions command the AI agent to exfiltrate private session data—including the user’s name, approximate location, subscription tier, and full chat history—to an attacker-controlled server via URL parameters.

Adversa AI reported a 40% success rate in their testing of the Grok web chat. The vulnerability highlights a security gap where the unit of execution (the Python sandbox) diverges from the unit of security inspection (the API string filters). As of the report, there is no available patch, CVE identifier, or user-facing workaround.