Grok Zero-Click Attack Steals Chat Data Using Encrypted Prompt Injection

A newly disclosed attack can turn a routine “summarize this page” request in xAI’s Grok web chat into a silent theft of the user’s name, coarse location, subscription tier, and the prompt history of the active conversation.

Adversa AI said in a report shared with Cyber Security News (CSN) that the method, named Cryptographic Context Injection, hides attacker commands inside AES-256-GCM ciphertext so input filters never read them, then induces the model to decrypt and trust those commands as its own code-sandbox output.

Lead researcher Rony Utevsky said the payload sits on an ordinary-looking webpage as an encrypted JSON object, next to key material and a short instruction to decrypt it in the agent’s Python runtime.

Static guardrails classify text; they do not run PBKDF2 and AES-256-GCM. Unlike older evasion tricks such as Base64 or substitution ciphers, strong encryption cannot be recovered inside the model’s weights, so the only path is the interpreter. Once the sandbox returns plaintext, Grok treats that result the way a program treats its own internal state, not as untrusted web content.

The decrypted instructions then tell the agent to resolve private session context and fold it into a fake “decryption key,” which is really a template string interpolating the victim’s identity and chat history.

Grok is told to open a URL “to fetch additional context,” and its privileged navigation tool loads the attacker-controlled address with the stolen data in the query string.

In the proof of concept against Grok 4.5 Fast on grok.com, the transfer finished with no confirmation dialog and no visible warning, a true zero-click outcome on a live production system.

Adversa first reported the issue to xAI and its HackerOne program on June 3, 2026. xAI acknowledged the ticket but offered no mitigation timeline, and follow-ups on August 4 and August 10 drew no further reply.

The researchers said they could still reproduce the chain on August 19. Across about 20 attempts since June, the success rate was roughly 40 percent, with failures coming from decryption errors rather than a blocked prompt. There is no CVE, no public patch, and no reported abuse in the wild. Operational payloads were withheld.

The same cryptographic backbone was shown against Google Gemini in Deep Thinking mode, identified from extracted system text as Gemini 3 Flash on the paid web tier. A single prompt asked Gemini to decrypt a blob whose plaintext was a fabricated Python traceback carrying a fake safety-policy callback and a first-person reasoning prefix.

Because the model treated the sandbox result as its own work, it produced restricted content its filters normally suppress and, with a modified payload, reproduced system instructions it is told not to disclose.

Google was not notified because jailbreaks sit outside its vulnerability program. Adversa said the Gemini success rate had fallen sharply by August, possibly due to filter or model changes.

The finding lands in a wider pattern of chat data theft from agentic assistants that can browse, run code, and call outbound tools. Prompt injection is no longer just a string pasted into a prompt; it is a fight over any context an agent treats as its own, including tool output and runtime state.

Utevsky argued the fix lives in the harness, not the weights: quarantine fetched pages away from privileged tools, require consent for new destinations with fully resolved arguments, keep per-session traces, and alert on the sequence of untrusted content, code execution, and unexpected egress.

Until Grok separates provenance on that path, users should treat summarizing unknown pages as an action that can expose the current chat.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC