Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages

Key facts

Detection coverage

As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2112 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Encrypted-Payload Webpage Fetch Correlated with AI Chat Browsing Session (Cryptographic Context Injection — Delivery)

Detects a proxy/CASB session to an AI chat platform (grok.com, Gemini) closely followed by the agent fetching or summarizing an external webpage whose content contains PBKDF2/AES-256-GCM ciphertext markers. This is the drive-by delivery stage of Cryptographic Context Injection: the payload is encrypted so a pre-execution content classifier scanning the static page text never flags it as an injection attempt.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T0078, T0051.001, T0068
• Data sources: zscaler_web_proxy, netskope_webtx, cloudappevents_mdca
• Severity: high
• Confidence: medium

Splunk SPL

index=proxy (sourcetype=zscaler:web OR sourcetype=netskope:webtx)
```Flag AI-chat sessions and encrypted-payload page fetches, then correlate per user/src_ip```
| eval is_ai_chat=if(match(dest_hostname, "(?i)(grok\.com|gemini\.google\.com)"), 1, 0)
| eval is_crypto_page=if(match(coalesce(http_content, page_text, ""), "(?i)(pbkdf2|aes-256-gcm|aes\.gcm|ciphertext|decrypt this|decryption[_ ]key)"), 1, 0)
| eval payload_len=len(coalesce(base64_blob, ""))
| where is_ai_chat=1 OR (is_crypto_page=1 AND payload_len>2000)
| stats count as event_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(dest_hostname) as hosts, values(is_ai_chat) as ai_chat_flags, values(is_crypto_page) as crypto_flags by user, src_ip
| where event_count>1 AND mvfind(ai_chat_flags, "1")>=0 AND mvfind(crypto_flags, "1")>=0
| eval risk="high — AI-chat session correlated with encrypted-payload webpage fetch within the same window"
| table first_seen, last_seen, user, src_ip, hosts, event_count, risk
| sort -first_seen

Microsoft KQL

CloudAppEvents
| where Timestamp > ago(24h)
| where Application in ("Grok", "xAI Grok", "Google Gemini")
| project ChatTime=Timestamp, AccountId, AccountDisplayName, IPAddress, Application
| join kind=inner (
    CloudAppEvents
    | where Timestamp > ago(24h)
    | where ActivityType in ("Viewed page", "Uploaded file", "Fetched content", "Browsed page")
    | where RawEventData has_any ("pbkdf2", "aes-256-gcm", "ciphertext", "decryption_key", "decrypt this")
    | project PageTime=Timestamp, AccountId, ActivityType, ObjectName, RawEventData
) on AccountId
| where PageTime between ((ChatTime - 5m) .. (ChatTime + 5m))
| summarize EventCount=count(), Activities=make_set(ActivityType), Pages=make_set(ObjectName) by AccountDisplayName, IPAddress, bin(ChatTime, 5m)
| where EventCount > 0
| project ChatTime=bin_ChatTime, AccountDisplayName, IPAddress, EventCount, Activities, Pages

Sigma

title: Encrypted-Payload Webpage Fetch Correlated with AI Chat Browsing Session
id: 7e2b1a44-6c3f-4b8e-9a2d-1f6c8e0b5a11
status: experimental
description: Detects a proxy session to an AI chat platform (Grok, Gemini) closely followed by an HTTP fetch of external page content containing PBKDF2/AES-256-GCM ciphertext markers, the drive-by delivery stage of Cryptographic Context Injection.
references:
    - https://gbhackers.com/zero-click-grok-attack-prompt-injection/
    - https://thehackernews.com/2026/08/new-cryptographic-context-injection.html
author: Threadlinqs Team
date: 2026-08-22
tags:
    - attack.execution
    - attack.defense-evasion
    - ai_atlas.aml_t0078
    - ai_atlas.aml_t0051_001
    - ai_atlas.aml_t0068
logsource:
    category: proxy
    product: zscaler
detection:
    selection_ai_chat:
        c-uri|contains:
            - 'grok.com'
            - 'gemini.google.com'
    selection_crypto_page:
        cs-content|contains:
            - 'pbkdf2'
            - 'aes-256-gcm'
            - 'ciphertext'
            - 'decryption_key'
    condition: selection_ai_chat and selection_crypto_page
falsepositives:
    - Legitimate cryptography documentation or educational pages summarized by the AI agent
    - Security-research pages referencing PBKDF2/AES-GCM by name without embedding an executable payload
level: high

Known false positives:

• Legitimate cryptography documentation or research pages summarized by the AI agent without an embedded executable payload
• Security researchers deliberately testing the agent's own injection defenses with benign encrypted test pages

Tuning notes: Tune the crypto-marker regex against your proxy's actual content-inspection field name (varies by vendor — Zscaler uses different DLP field naming than Netskope); narrow the 5-minute correlation window if AI-chat usage is very high-volume in your environment to reduce noise, and add an allowlist for known internal security-training domains that legitimately host PBKDF2/AES-GCM demo pages.

• 🔒 Encrypted-Payload Webpage Fetch Correlated with AI Chat Browsing Session (Cryptographic Context Injection — Delivery) · unlock with TL Creds
• 🔒 AI Code-Interpreter Decryption of Untrusted Web Content Without User Confirmation (Trusted-Output Manipulation) · unlock with TL Creds
• 🔒 Post-AI-Chat Outbound Navigation with Encoded User/Session Data in URL Query Parameter (Cryptographic Context Injection — Exfiltration) · unlock with TL Creds
• 🔒 Encrypted-Payload Webpage Fetch Correlated with AI Chat Browsing Session (Cryptographic Context Injection — Delivery) · unlock with TL Creds
• 🔒 AI Code-Interpreter Decryption of Untrusted Web Content Without User Confirmation (Trusted-Output Manipulation) · unlock with TL Creds
• 🔒 Post-AI-Chat Outbound Navigation with Encoded User/Session Data in URL Query Parameter (Cryptographic Context Injection — Exfiltration) · unlock with TL Creds
• 🔒 AI Code-Interpreter Decryption of Untrusted Web Content Without User Confirmation (Trusted-Output Manipulation) · unlock with TL Creds
• 🔒 Post-AI-Chat Outbound Navigation with Encoded User/Session Data in URL Query Parameter (Cryptographic Context Injection — Exfiltration) · unlock with TL Creds

Indicators of compromise

As of 2026-08-22, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-2112.

Technical analysis

No CVE has been assigned, no patch is available, and there is no evidence of in-the-wild exploitation.

Adversa AI researcher Rony Utevsky disclosed a technique dubbed "Cryptographic Context Injection" affecting xAI's Grok web chat agent (Grok 4.5 Fast, grok.com). An attacker hosts a webpage containing an encrypted JSON object, PBKDF2-derived key material, and a short instruction asking the AI to decrypt the blob using its own Python runtime. When a user asks Grok to summarize or otherwise process the page, the model's code-interpreter sandbox performs the AES-256-GCM decryption itself, recovering plaintext instructions that a pre-execution content classifier or guardrail scanner was never able to inspect because it does not execute cryptographic functions during static text scanning.

The core trust-boundary failure is that Grok treats the runtime-decrypted output as reliable tool output or internal runtime state rather than untrusted third-party webpage content -- the same text would be rejected as an obvious injection attempt if pasted directly into the chat. The decrypted instructions direct the model to gather the user's name, approximate location, subscription tier, and active conversation history, embed that data into what appears to be a "decryption key" template, and exfiltrate it by navigating to an attacker-controlled URL with the data encoded in a query parameter -- all without a confirmation step or visible warning to the user. Utevsky reported roughly a 40% success rate across 20 attempts since June 2026, with failures attributed to Grok's decryption reliability rather than any prompt-injection defense triggering.

The same encrypted-payload class was previously demonstrated by Utevsky on March 11, 2026 against Google Gemini's Deep Thinking mode under the name "Cryptographic Payload Injection," combining the encrypted blob with a fabricated Python traceback and chain-of-thought hijacking to reliably bypass Gemini's safety policies in a single prompt (independently reproduced 5 of 5 times). A secondary, less detailed test of an encrypted-blob technique against Gemini 3 Flash Web (Deep Thinking, paid tier) was also referenced in the Grok disclosure reporting, with SecurityWeek noting its effectiveness has been declining. Cross-model testing found OpenAI's GPT-5 failed to parse the decryption instructions at all, while Anthropic's Claude Sonnet 4.5 successfully decrypted the payload but then flagged the recovered content as a prompt injection attempt rather than acting on it.

Adversa AI reported the Grok vulnerability to xAI via HackerOne on June 3, 2026. xAI acknowledged the submission but provided no mitigation timeline; follow-up messages on August 4 and August 10, 2026 went unanswered. Utevsky confirmed the attack was still reproducible on August 19, 2026, and the finding was disclosed publicly starting August 20-22, 2026 across The Register, The Hacker News, SecurityWeek, and GBHackers. As of disclosure, no CVE has been assigned, no patch or vendor advisory exists, and there is no evidence of exploitation outside the researcher's own proof-of-concept testing.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051.001 Indirect; AML.T0053 AI Agent Tool Invocation

Defense Evasion

AML.T0054 LLM Jailbreak

Exfiltration

AML.T0057 LLM Data Leakage

Remediation

Immediate actions

• Quarantine untrusted webpage/document content ingested by the agent so it cannot be executed as instructions or merged into trusted tool-output context
• Require explicit user confirmation before any outbound navigation or network call that embeds user/session data in a URL query parameter
• Restrict or disable automatic Python/code-interpreter invocation when the agent is summarizing or processing third-party web content

Workarounds

• Avoid using Grok's or Gemini's web-page summarization/browsing features on untrusted or attacker-influenced pages until a fix ships
• Disable third-party web-browsing or page-summarization tool access for the chat agent where it is not strictly required

Longer-term hardening

• Enforce provenance separation so runtime-decrypted or tool-recovered content is always tagged and treated as untrusted, never merged into trusted tool-output or internal reasoning state (see AML.T0067)
• Detect and alert on the composite behavior chain of untrusted-content ingestion -> code execution -> sensitive-context access -> outbound network egress, rather than screening individual payloads
• Push vendors (xAI, Google) for transparency on how context provenance is separated between user-trusted instructions and tool/content-derived instructions

Affected and fixed versions

• xAI — Grok web chat (grok.com)
  Vulnerable versions: Grok 4.5 Fast
• Google — Gemini
  Vulnerable versions: Gemini 3 Flash Web, Deep Thinking mode (paid tier)

Timeline

• 2026-03-11 Rony Utevsky (Adversa AI) publishes 'Cryptographic Payload Injection', a related jailbreak combining an encrypted payload, a fake Python traceback, and chain-of-thought hijacking against Google Gemini's Deep Thinking mode; independently reproduced 5 of 5 times.
• 2026-06-03 Adversa AI reports the Cryptographic Context Injection vulnerability in Grok's web chat to xAI via HackerOne.
• 2026-08-04 Adversa AI sends a first follow-up message to xAI after receiving no substantive response to the June report.
• 2026-08-10 Adversa AI sends a second follow-up message to xAI; xAI again provides no mitigation timeline.
• 2026-08-19 Utevsky confirms the attack is still reproducible against Grok 4.5 Fast on grok.com, with roughly a 40% success rate across 20 attempts since June.
• 2026-08-20 The Register publishes the first public report of the Cryptographic Context Injection attack against Grok.
• 2026-08-21 The Hacker News, SecurityWeek, SC Media, TechBriefly, Dataconomy and other outlets cover the disclosure; SecurityWeek notes a related encrypted-blob technique against Google Gemini with declining effectiveness.
• 2026-08-22 GBHackers publishes additional coverage; no CVE has been assigned and no patch is available from xAI.

Sources cited

• Cryptographic Payload Injection: A Novel Jailbreak Technique Against Gemini ronyut.me · Research · 2026-03-11
• Zero-Click Grok Attack Lets Hackers Steal Chat History Using Encrypted Prompt Injection gbhackers.com · News · 2026-08-22
• New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data The Hacker News · News · 2026-08-21
• Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini SecurityWeek · News · 2026-08-21
• Grok chat duped into swallowing injected instructions The Register · News · 2026-08-20
• New attack bypasses AI guardrails by encrypting malicious prompts scworld.com · News · 2026-08-21
• Grok web chat agent vulnerable to cryptographic context injection attack techbriefly.com · News · 2026-08-21
• AI Security Threat: How Encrypted Malicious Prompts Bypass Guardrails news4hackers.com · News · 2026-08-21
• XAI's Grok Chat Agent Vulnerable To Cryptographic Context Injection Attack dataconomy.com · News · 2026-08-21

Related threats

• CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing
• Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts
• 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285
• OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and Scope Violations Found in Safety Testing
• OWASP GenAI LLM Top 10 2026 — Community-Driven Security Guidance for AI Applications

Previous and next in vulnerability

• CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted Data Previous report
• Critical Type Confusion in isolated-vm (GHSA-864f-rcv7-6rh4) Enables Sandbox Escape and RCE on Host Next report