Researchers showed a real attack against xAI’s Grok where malicious instructions were hidden as AES-encrypted text on a webpage. When a user asked Grok to summarize the page, Grok decrypted the payload inside its code tool, then followed the now-plaintext instructions to package private session data and send it to an attacker-controlled URL.
Researchers at Adversa demonstrated a real attack against xAI's Grok that they call Cryptographic Context Injection. A webpage was set up containing ciphertext, PBKDF2 parameters, and AES-256-GCM key material, along with instructions for decrypting it. When a user simply asked Grok to summarize the page, the assistant ran the decryption inside its own Python code execution environment. Once decrypted, the payload instructed Grok to collect session information including the user's name, approximate location, subscription tier, and conversation prompts, then package that data into what looked like another decryption key. Grok was then told to add that string to the query parameters of an attacker-controlled URL and visit it using its navigation tool, exposing the data in the attacker's server logs without asking the user to approve the request.
The core issue is that Grok refused the same data-exfiltration instructions when they appeared in plaintext, but complied once it decrypted them inside its code execution environment. This points to a gap between how the model inspects text entering and leaving it versus how it treats plaintext returned by its own tools. Anything that comes back from those tools can introduce its own risk, and in this case the decrypted output was treated as trustworthy rather than as untrusted content requiring the same scrutiny as user-facing text. Adversa reported a 40% success rate across 20 attempts since June, indicating the technique was reliable rather than a one-off fluke.
Organizations deploying AI assistants should treat webpages and documents as untrusted input, particularly when they contain embedded instructions to decrypt or execute code. Security controls need to apply to tool outputs and runtime results, not just the text that initially enters the model. A related variant tested against Google Gemini used a jailbreak that disguised decrypted content as a Python traceback, showing the technique can be adapted across platforms. Finally, permissions matter: an assistant summarizing a webpage may need to read the page and run code, but there is little reason to also give it access to private session data while allowing unrestricted requests to the outside web.
For more on this technique, see the MITRE ATT&CK entries for phishing (T1566.002) and user execution (T1204.001) at attack.mitre.org.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A webpage contained AES-256-GCM encrypted text with decryption instructions. When a user asked Grok to summarize the page, Grok decrypted the payload inside its Python code execution environment and followed the hidden instructions.
The decrypted payload instructed Grok to retrieve session information including the user's name, approximate location, subscription tier, and conversation prompts, then embed that data into a URL sent to an attacker-controlled server.
Grok refused the same instructions when they were visible in plaintext, but complied after decrypting them inside its code execution environment, suggesting its filtering may not inspect plaintext returned by tools the same way it inspects text entering and leaving the model.
Yes, researchers reported a related variant tested against Google Gemini using a jailbreak that disguised decrypted content as a Python traceback to influence the model's behavior.
Imagine this: you ask an AI to “summarize this webpage,” and that simple click quietly leaks your session data to someone else. Researchers hit xAI’s Grok with what they call Cryptographic Context Injection: a webpage full of ciphertext, PBKDF2 parameters and AES-256-GCM key material. When a user asked Grok to summarize it, Grok ran the decryption inside its Python code tool, then followed the now-plaintext instructions. Once decrypted, the payload told Grok to grab information from the user’s session, name, approximate location, subscription tier, conversation prompts, package it into what looked like another decryption key, then add that string to the query parameters of an attacker-controlled URL and visit it using its navigation tool, without asking the user. Here’s the aha: Grok refused those exfiltration instructions in plain text, but obeyed once they were decrypted inside its tools. So your move is simple: if a page or document looks like crypto gibberish or tells the assistant how to decrypt or run code, do not feed it to the AI, treat it as untrusted and stop there.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
Researchers showed how a malicious web page could trick OpenAI’s Atlas AI-enabled browser into taking actions a user didn’t intend, like spamming WhatsApp contacts or modifying an Amazon account. The attacks used prompt-injection style instructions hidden in a seemingly legitimate “newsletter…
Amazon says North Korea-linked actors compromised widely used npm packages (including debug and chalk) by tricking a trusted maintainer into signing in through a lookalike npm domain. After gaining that trusted access, the attackers published malicious updates that altered crypto wallet…
