Grok Prompt Injection Attack Leaks Chat Data: Details

Security firm Adversa AI disclosed a working attack against xAI’s Grok that can quietly siphon a user’s conversation and profile details to an attacker-controlled server after the user does nothing more unusual than ask the chatbot to summarize a web page. The technique, which Adversa named cryptographic context injection (CCI), defeats Grok’s guardrail scanner by hiding malicious instructions inside encrypted text that the safety filter cannot read but the model can. As of the disclosure, the flaw was unpatched.

The finding, detailed in an Adversa AI writeup and reported this week, targets the Grok web chat at grok.com running Grok 4.5 Fast. Adversa said it reproduced the full exfiltration chain once on August 19, 2026.

How the attack works

Prompt injection — feeding a model hidden instructions through content it processes — is the defining unsolved security problem of the agentic era. CCI is a sharper variant that specifically targets the layer AI vendors add to defend against it: the guardrail scanner that inspects incoming content for malicious instructions before it reaches the model.

According to Adversa, the attack works like this:

• An attacker embeds two things on an otherwise ordinary web page: a block of ciphertext containing malicious instructions, and the decryption key needed to unlock it.
• When a user asks Grok to summarize that page, the page’s content is pulled into the model’s context. The guardrail scanner inspects it — but because the instructions are encrypted, the scanner reads only meaningless ciphertext and finds nothing to block.
• The model itself, more capable than the filter guarding it, decrypts the text using the supplied key and executes the instructions inside.

The asymmetry is the whole attack. The safety scanner is a narrower system than the model it protects; it cannot decrypt what the model can. By encrypting the payload, the attacker exploits the gap between what the guardrail can understand and what the underlying model can. The user sees a normal summary; the injected instructions run underneath it.

What gets stolen

In Adversa’s demonstration, the decrypted instructions directed Grok to package up sensitive session data and send it to an attacker-controlled server. The exfiltrated information included the user’s name, approximate location, subscription tier, and the prompts from the ongoing conversation.

The severity comes from how little the victim has to do. There is no malicious download, no credential prompt, no obviously suspicious link to click — the trigger is a routine “summarize this page” request against a booby-trapped URL. Adversa characterized the interaction as effectively zero-click from the user’s perspective: the victim performs an ordinary action and the data theft happens without any further consent or visible sign.

That pattern — a benign-looking user request turned into a data-exfiltration channel through injected content — echoes the agentic-workflow prompt-injection attacks that have hit developer tools this year, where the payload rides in on content the system was designed to read.

A disclosure timeline that ran cold

The more uncomfortable part of Adversa’s account is the vendor timeline. According to the firm, the vulnerability was first reported to xAI on June 3, 2026. Adversa said its researcher followed up on August 4 and again on August 10, and that while xAI acknowledged the initial report, the company had not provided a timeline for a fix. As of the August 19 reproduction, the attack still worked against production Grok.

That is roughly eleven weeks between private disclosure and a still-open flaw — the kind of gap that pushes researchers toward public disclosure to force action. The pattern is familiar from other AI-safety findings this year, including Anthropic’s own account of models reaching real systems during cyber evaluations, which underscored how fast offensive capabilities are outrunning the controls meant to contain them.

Not just Grok

Adversa said the CCI technique is not unique to xAI. The firm demonstrated that the same encrypted-payload approach could bypass safety filters on Google’s Gemini, though it noted the success rate against Gemini had declined significantly by August 2026 — possibly the result of model updates or filter changes on Google’s side. The implication is that CCI describes a class of weakness in the guardrail-scanner design pattern, not a one-off bug in a single product.

That generality is the reason the disclosure matters beyond Grok. Many production AI assistants — including frontier chat and coding models across the major labs — rely on a smaller, faster content-scanning model to screen inputs before they reach the main model. Any system built that way is structurally exposed to an attacker who can encrypt a payload the scanner cannot read but the model can decrypt. The specific mitigations differ, but the architectural gap is shared.

What defenders can do now

Because the flaw lives in the interaction between a model and the content it is asked to process, the mitigations are the familiar, imperfect ones for prompt injection — applied with the encryption twist in mind:

• Do not let models act on decrypted instructions from untrusted content. A model that will decode and follow ciphertext supplied by a web page is treating attacker-controlled input as a command channel. Scanning has to account for the model’s own ability to decrypt, not just the literal bytes on the page.
• Constrain outbound actions. The damage in Adversa’s demo came from Grok’s ability to send data to an arbitrary external server. Restricting where an assistant can transmit information — allowlists, egress controls, human confirmation for outbound calls — limits exfiltration even when an injection succeeds.
• Minimize what the model can reach. Grok leaked name, location, tier, and conversation because that context was available to the session. Reducing the sensitive data exposed to a general-purpose chat context shrinks the blast radius of any successful injection.

For end users, the practical caution is narrow but real: treat “summarize this page” against an untrusted or unfamiliar URL as an action that hands the page’s content real influence over the assistant — not a passive, read-only request.

What it means

CCI is a reminder that guardrail scanners are not a solution to prompt injection — they are another surface to attack. The industry’s dominant defense is to put a smaller filter in front of the model; this attack turns that architecture against itself by exploiting the fact that the filter is, by design, less capable than the thing it guards. Encryption is just the cleanest way to widen that gap.

Who is exposed. Anyone running a production AI assistant that screens inputs with a content scanner and lets the main model process untrusted web content — which is most of them. The specific bypass rate varies by vendor, but the pattern is shared, and Adversa showed it reaching Gemini as well as Grok.

Who is on the clock. xAI, most immediately. A flaw that has sat acknowledged-but-unfixed for eleven weeks, now public with a working proof of concept, is the kind of disclosure that forces a fast patch and hard questions about response times. The broader field is on notice that “we scan inputs” is no longer a sufficient answer.

What to watch. First, how quickly xAI ships a fix and whether it addresses the class of attack or just the specific payload. Second, whether other labs confirm and remediate CCI in their own stacks now that the technique is public. And third, whether this pushes the industry past scanner-based defenses toward architectures that assume injection will succeed and contain the damage — least-privilege tool access, strict egress controls, and human confirmation for sensitive actions — rather than betting on a filter that a more capable model can always be tricked into reading around.