Security firm Adversa has disclosed a prompt injection attack against Grok, the LLM owned by Elon Musk's xAI, that exfiltrates user data. Researcher Rony Utevsky found that safety filters can be bypassed by encrypting the malicious instruction instead of writing it in plaintext. The attacker hosts a page containing the ciphertext, the decryption key and plaintext directions for decrypting it. When a user asks Grok to summarize the page, the model follows the hidden command with no warning and no confirmation.

The decrypted instruction tells Grok to construct what looks like a decryption key. In reality the value contains the user's name, location and chat history. Grok appends it as a parameter to a URL pointing to the attacker's server and opens the link, leaving the data in the server logs. Adversa informed xAI in June, but at publication time the assistant still leaked the data.

The working theory behind the bypass is that Grok's guardrails inspect text entering and leaving the model, but not the output of its own code execution. A request to process ciphertext with PBKDF2 and AES-256-GCM looks like an ordinary task to a static classifier, since resolving what the ciphertext unlocks would require actually running the decryption. Once Grok decrypts the payload in its sandbox, the instructions arrive as the model's own tool output and are acted on unfiltered.

Adversa applied a related technique to Google's Gemini as a jailbreak. There the ciphertext decrypted into something resembling a Python traceback with a rule telling the model to read the error message and act on it. The injected prompt made Gemini produce restricted content, including instructions for building an incendiary weapon, and with a modified payload it reproduced Gemini's system instructions. Adversa did not report this to Google because jailbreaks fall outside the company's vulnerability disclosure program. In recent weeks Gemini has grown more resistant to the attack, though the firm cannot say whether filter updates or model changes caused it.

The researchers call the technique cryptographic context injection and place it in a broader class of attacks that manipulate not just the prompt but the wider context an LLM treats as its own, such as tool outputs and runtime results. The disclosure follows a similar attack on Microsoft 365 Copilot reported days earlier, in which a secret input caused the assistant to exfiltrate a password from a user's inbox.