Researchers demonstrated a technique where encrypted instructions bypass AI safety filters because the filters can’t interpret the ciphertext. In examples against xAI’s Grok and Google’s Gemini, the model is tricked into decrypting attacker-supplied text inside a trusted environment, enabling data leakage or the generation of restricted content. The attack can be delivered directly in chat or indirectly by luring a user to have an AI agent analyze a weaponized web page.
Researchers demonstrated a technique called Cryptographic Context Injection, where instructions are encrypted before being sent to an AI system. Because safety guardrails classify prompt text without executing it, they cannot interpret ciphertext and let it pass through as if it were harmless. Once inside a trusted environment, the model is asked to decrypt the payload using its own code execution capability, at which point the hidden instructions take effect.
The payload can reach a target in two ways. It can be pasted directly into a chat window, or it can be embedded in a web page that a user asks an AI agent to analyze, turning an ordinary browsing task into a watering hole style attack.
In the Grok example, researchers described a zero click data exfiltration attack against the web chat and agentic browsing framework. A weaponized page contained an encrypted JSON object along with an instruction for the agent to decrypt it using its Python runtime. The resulting plaintext prompt instructed the agent to resolve its private session context and embed that data into a URL, which the agent then loaded on its own, transmitting user data to the attacker.
In the Gemini example, encryption was used differently. A single prompt instructed the model to run a Python script that decrypts supplied ciphertext, and the decrypted prompt could then push the model to produce restricted content framed as something it will encrypt for safety. The prohibited data was gathered, encrypted, and returned to the user, bypassing output checks that would normally catch such content in plain text.
Teams that use AI chatbots or agentic browsing tools should treat any request to paste or process encrypted content as suspicious, particularly when it asks the AI to decrypt or execute code. Employees should also be cautious when directing AI agents to summarize or analyze external web pages, since untrusted page content can function like instructions rather than plain data. Encryption should never be assumed to make a prompt safer. As researchers noted, the attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt. Organizations using agentic browsing frameworks should also review how much autonomy these tools have to access session data or load external URLs without explicit user confirmation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is an attack technique that uses encrypted prompts to evade AI input and output safety guardrails, since the filters cannot interpret ciphertext and let it pass through unchecked.
The encrypted payload can be delivered directly in a chat message or indirectly through a watering hole web page that a user asks an AI agent to analyze.
Researchers described a zero click data exfiltration attack that could leak private session context and conversation history via an attacker-controlled URL.
The decrypted prompt can instruct the model to produce restricted content framed as something it will encrypt for safety, which lets it slip past output guardrails.
Imagine this: you paste a weird encrypted blob into an AI chat, and that’s exactly how data walks out the door. Researchers call this Cryptographic Context Injection. With Grok and Gemini, encrypted prompts slipped past safety, got decrypted inside the AI’s Python runtime, and then quietly told the agent to grab private session context and send it to an attacker URL. Here’s the trick: the encrypted attack can be sent directly in chat, or hidden on a 'watering hole' web page. You ask the AI to analyze the page, it decrypts a JSON blob, reads your private context, then loads a malicious URL, zero clicks from you. The move to remember: if someone asks you to paste encrypted or opaque text into an AI, or have an agent analyze a page full of ciphertext or hidden JSON, stop and escalate to Security, don’t run it.
Researchers demonstrated a technique that can trick xAI’s Grok into leaking a user’s chat prompts and some session details to an attacker-controlled server when the user asks Grok to summarize a web page. The attack hides malicious instructions inside encrypted content on the page, which Grok is…
A security researcher demonstrated a “Cryptographic Context Injection” attack where a normal request like “summarize this page” can cause an AI agent (xAI Grok) to decrypt hidden instructions from a webpage and exfiltrate a user’s private chat history, without any warning or user click. The same…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
Researchers disclosed a one-click flaw in Atlassian’s Rovo AI assistant where a specially crafted link could pre-fill attacker instructions into a user’s active Rovo chat. After a user clicks once, Rovo’s autonomous agent features could pull sensitive data from connected systems (like Confluence,…
Zenity demonstrated real-world attack chains where hidden instructions in emails or content on X can hijack AI “agentic browsers” (ChatGPT Atlas and the Claude Chrome extension). In the demos, the AI agent can be steered to perform actions in the user’s already logged-in sessions, sending phishing…
