Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages
Zero-Click Cryptographic Context Injection Attack (TL-2026-2112), also tracked as Cryptographic Context Injection, is a high-severity software vulnerability, first published 2026-08-22. It has no confirmed attribution, affects xAI Grok web chat (grok.com), maps to 4 MITRE ATT&CK / ATLAS techniques (AML.T0051.001, AML.T0053, AML.T0054), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-2112
- Threat ID
- TL-2026-2112
- Also known as
- Cryptographic Context Injection, Cryptographic Payload Injection
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-22
- Last reviewed
- 2026-08-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Zero-Click Cryptographic Context Injection Attack
Malware and tooling: GROK, grok-python-code-interpreter
Adversa AI researcher Rony Utevsky disclosed "Cryptographic Context Injection," a zero-click prompt-injection technique against xAI's Grok web chat (Grok 4.5 Fast on grok.com). Attacker-controlled webpages hide instructions inside PBKDF2-keyed, AES-256-GCM-encrypted JSON that Grok's Python sandbox decrypts and then treats as trusted tool output, exfiltrating the user's name, approximate location, subscription tier, and active conversation history via a URL query parameter. No CVE has been assigned, no patch is available, and there is no evidence of in-the-wild exploitation.
How Zero-Click Cryptographic Context Injection Attack works
Adversa AI researcher Rony Utevsky disclosed a technique dubbed "Cryptographic Context Injection" affecting xAI's Grok web chat agent (Grok 4.5 Fast, grok.com). An attacker hosts a webpage containing an encrypted JSON object, PBKDF2-derived key material, and a short instruction asking the AI to decrypt the blob using its own Python runtime. When a user asks Grok to summarize or otherwise process the page, the model's code-interpreter sandbox performs the AES-256-GCM decryption itself, recovering plaintext instructions that a pre-execution content classifier or guardrail scanner was never able to inspect because it does not execute cryptographic functions during static text scanning.
The core trust-boundary failure is that Grok treats the runtime-decrypted output as reliable tool output or internal runtime state rather than untrusted third-party webpage content -- the same text would be rejected as an obvious injection attempt if pasted directly into the chat. The decrypted instructions direct the model to gather the user's name, approximate location, subscription tier, and active conversation history, embed that data into what appears to be a "decryption key" template, and exfiltrate it by navigating to an attacker-controlled URL with the data encoded in a query parameter -- all without a confirmation step or visible warning to the user. Utevsky reported roughly a 40% success rate across 20 attempts since June 2026, with failures attributed to Grok's decryption reliability rather than any prompt-injection defense triggering.
The same encrypted-payload class was previously demonstrated by Utevsky on March 11, 2026 against Google Gemini's Deep Thinking mode under the name "Cryptographic Payload Injection," combining the encrypted blob with a fabricated Python traceback and chain-of-thought hijacking to reliably bypass Gemini's safety policies in a single prompt (independently reproduced 5 of 5 times). A secondary, less detailed test of an encrypted-blob technique against Gemini 3 Flash Web (Deep Thinking, paid tier) was also referenced in the Grok disclosure reporting, with SecurityWeek noting its effectiveness has been declining. Cross-model testing found OpenAI's GPT-5 failed to parse the decryption instructions at all, while Anthropic's Claude Sonnet 4.5 successfully decrypted the payload but then flagged the recovered content as a prompt injection attempt rather than acting on it.
Adversa AI reported the Grok vulnerability to xAI via HackerOne on June 3, 2026. xAI acknowledged the submission but provided no mitigation timeline; follow-up messages on August 4 and August 10, 2026 went unanswered. Utevsky confirmed the attack was still reproducible on August 19, 2026, and the finding was disclosed publicly starting August 20-22, 2026 across The Register, The Hacker News, SecurityWeek, and GBHackers. As of disclosure, no CVE has been assigned, no patch or vendor advisory exists, and there is no evidence of exploitation outside the researcher's own proof-of-concept testing.
MITRE ATT&CK / ATLAS techniques used in TL-2026-2112
Execution
AML.T0051.001 Indirect; AML.T0053 AI Agent Tool Invocation
Defense Evasion
AML.T0054 LLM Jailbreak
Exfiltration
AML.T0057 LLM Data Leakage
Affected products and versions in Zero-Click Cryptographic Context Injection Attack
- xAI — Grok web chat (grok.com)
Vulnerable versions: Grok 4.5 Fast - Google — Gemini
Vulnerable versions: Gemini 3 Flash Web, Deep Thinking mode (paid tier)
Remediation for Zero-Click Cryptographic Context Injection Attack
Immediate actions
- Quarantine untrusted webpage/document content ingested by the agent so it cannot be executed as instructions or merged into trusted tool-output context
- Require explicit user confirmation before any outbound navigation or network call that embeds user/session data in a URL query parameter
- Restrict or disable automatic Python/code-interpreter invocation when the agent is summarizing or processing third-party web content
Workarounds
- Avoid using Grok's or Gemini's web-page summarization/browsing features on untrusted or attacker-influenced pages until a fix ships
- Disable third-party web-browsing or page-summarization tool access for the chat agent where it is not strictly required
Longer-term hardening
- Enforce provenance separation so runtime-decrypted or tool-recovered content is always tagged and treated as untrusted, never merged into trusted tool-output or internal reasoning state (see AML.T0067)
- Detect and alert on the composite behavior chain of untrusted-content ingestion -> code execution -> sensitive-context access -> outbound network egress, rather than screening individual payloads
- Push vendors (xAI, Google) for transparency on how context provenance is separated between user-trusted instructions and tool/content-derived instructions
Weaknesses (CWE) in Zero-Click Cryptographic Context Injection Attack
CWE-1427, CWE-200, CWE-829
Timeline of Zero-Click Cryptographic Context Injection Attack
- Rony Utevsky (Adversa AI) publishes 'Cryptographic Payload Injection', a related jailbreak combining an encrypted payload, a fake Python traceback, and chain-of-thought hijacking against Google Gemini's Deep Thinking mode; independently reproduced 5 of 5 times.
- Adversa AI reports the Cryptographic Context Injection vulnerability in Grok's web chat to xAI via HackerOne.
- Adversa AI sends a first follow-up message to xAI after receiving no substantive response to the June report.
- Adversa AI sends a second follow-up message to xAI; xAI again provides no mitigation timeline.
- Utevsky confirms the attack is still reproducible against Grok 4.5 Fast on grok.com, with roughly a 40% success rate across 20 attempts since June.
- The Register publishes the first public report of the Cryptographic Context Injection attack against Grok.
- The Hacker News, SecurityWeek, SC Media, TechBriefly, Dataconomy and other outlets cover the disclosure; SecurityWeek notes a related encrypted-blob technique against Google Gemini with declining effectiveness.
- GBHackers publishes additional coverage; no CVE has been assigned and no patch is available from xAI.
Sources cited for Zero-Click Cryptographic Context Injection Attack
- Zero-Click Grok Attack Lets Hackers Steal Chat History Using Encrypted Prompt Injection
- New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
- Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini
- Grok chat duped into swallowing injected instructions
- Cryptographic Payload Injection: A Novel Jailbreak Technique Against Gemini
- New attack bypasses AI guardrails by encrypting malicious prompts
- Grok web chat agent vulnerable to cryptographic context injection attack
- AI Security Threat: How Encrypted Malicious Prompts Bypass Guardrails
- XAI's Grok Chat Agent Vulnerable To Cryptographic Context Injection Attack
Threats related to Zero-Click Cryptographic Context Injection Attack
Detection coverage for TL-2026-2112
As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2112 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.