Grok chat history leak: Cryptographic Context Injection

What it is

"Cryptographic Context Injection" (Adversa AI) — a prompt-injection technique that smuggles attacker instructions past LLM guardrails as AES-256-GCM ciphertext under a PBKDF2-derived key, shipped together with the key material and a decrypt instruction. Demonstrated for zero-click chat-history exfiltration against xAI Grok's agentic browsing, and for guardrail-refusal bypass against Gemini.

How it works

The novel property is why it beats content classifiers, which the summary doesn't explain. Static guardrails classify text; they don't execute it. Prior cipher-evasion attacks used weak, reversible schemes — base64, substitution, XOR, reordering — that a model decodes natively in-weights or in-context, so a classifier could in principle catch them. Strong encryption cannot be decoded in-weights at all, so recovery is forced through the model's code-execution sandbox (PBKDF2 + AES-256-GCM via standard Python libs). The decrypted plaintext then surfaces as output of code the model just ran, and the model treats its own runtime output as trusted internal state rather than as untrusted fetched content. That trust pivot is the whole attack; the page's analogy is SQL injection — a system that can't distinguish its own trusted query from attacker data on the same channel.

flowchart LR
  A[Page: ciphertext + key + decrypt instruction] --> B[Guardrail scans text]
  B -->|classifier cannot run AES| C[payload opaque, passes]
  C --> D[Model decrypts in sandbox]
  D --> E{trust boundary crossed}
  E --> F[plaintext treated as own runtime output = trusted]
  F --> G[instructions flow into privileged tool]
  G --> H[data embedded in URL, agent opens it → exfil]

Preconditions / Affected

An agent with a code-execution runtime capable of running AES/PBKDF2, that also processes untrusted external content (direct paste or indirect via browsing), and whose decrypted output can reach a privileged, internet-connected tool with no provenance or egress control. Grok web chat's agentic browsing is confirmed vulnerable; Gemini partially.

What to do

The fix is in the agent harness, not the model:

• Gate tool calls whose arguments derive from fetched or decrypted content.
• Tag data provenance through the harness so sandbox output isn't auto-trusted.
• Alert on the chain, not any single payload — since strong ciphertext is unscannable at inspection time, detection has to key on the pattern (fetch → decrypt → privileged tool call), not on classifying the payload itself.

Caveats

• Operational payloads are withheld; only the technique is disclosed.
• Reported to xAI June 2026, still reproducible against Grok as of August 19. Gemini's success rate has "fallen sharply since June" but is "not fully closed" — partial, not fixed.