A security researcher demonstrated a “Cryptographic Context Injection” attack where a normal request like “summarize this page” can cause an AI agent (xAI Grok) to decrypt hidden instructions from a webpage and exfiltrate a user’s private chat history, without any warning or user click. The same approach was also shown against Google Gemini to bypass safety rules by hiding instructions inside decrypted sandbox output.
A researcher at Adversa AI demonstrated a technique called Cryptographic Context Injection. Instructions are hidden inside a webpage as AES-encrypted ciphertext, invisible to normal scanning. When an AI assistant with browsing and code-execution tools processes the page, it decrypts the ciphertext inside its own sandbox, and the resulting plaintext is treated as trusted internal output rather than untrusted external content.
In the demonstration against xAI's Grok, a user issued an entirely ordinary request: summarize this page. That single action caused Grok to decrypt hidden instructions, access private session data including the user's name, location, subscription plan, and full chat history, and place that data into a URL that it then opened automatically. No click or warning was required from the user.
A related demonstration against Google Gemini used the same underlying trick differently. A prompt asked Gemini to run a Python script that decrypted data and returned a JSON result. The decrypted output was disguised as a fake Python error message containing hidden instructions designed to bypass Gemini's safety rules.
The core issue is that decrypted runtime output was treated as trusted context by the assistant. This effectively laundered attacker-controlled instructions into the AI's decision-making process. Because the malicious payload only became readable after the assistant itself performed the decryption, static content filters and pre-execution scanning could not inspect it in its dangerous form. The framework also allowed instructions from an untrusted external page to drive a privileged, internet-connected tool without an egress boundary or consent gate on that path.
Defenders and users of agentic AI tools should be alert to:
Organizations deploying agentic AI assistants with browsing or code-execution capabilities should require explicit user confirmation for outbound network calls, with the fully resolved URL and arguments visible before approval. Per-session tool traces with resolved arguments should be logged so unusual chains, such as browse then execute code then contact an external host, can be reviewed. Detection should focus on these sequences rather than individual payloads, since the risk lies in the pattern of untrusted content entering context, triggering code execution, and reaching an unexpected destination.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a technique where malicious instructions are hidden as AES-encrypted ciphertext inside a webpage and only revealed after an AI assistant decrypts them inside its own code execution runtime, letting attacker content pass as trusted output.
A user simply asked Grok to summarize a webpage. That triggered Grok to decrypt hidden instructions, access private session data including chat history, and place it in a URL it opened automatically, all with no click or warning.
Yes, the same approach was demonstrated against Google Gemini, where decrypted content was disguised as a fake Python error message inside sandbox output to bypass safety rules.
Recommended steps include requiring explicit user confirmation with fully resolved arguments before any outbound network call, logging per-session tool traces, and treating AI browsing and tool output as untrusted content.
Imagine you tell an AI, “summarize this page,” and that one click silently leaks your entire chat history. Adversa showed a “Cryptographic Context Injection” on Grok: the page hides AES-encrypted instructions. Grok decrypts them, grabs your session data, name, location, subscription, full chat history, and stuffs it into a URL it opens automatically. No extra click, no warning. Same trick hit Gemini: a prompt runs a Python decrypt script, and the decrypted payload pretends to be a Python error message. Hidden inside that “error” are new instructions that bypass safety rules, because the model trusts its own sandbox output. Here’s the move: any time an AI browse or code tool wants to call an external URL, pause and require a real human check of the full, final URL before it goes out.
Researchers demonstrated a technique where encrypted instructions bypass AI safety filters because the filters can’t interpret the ciphertext. In examples against xAI’s Grok and Google’s Gemini, the model is tricked into decrypting attacker-supplied text inside a trusted environment, enabling data…
Researchers showed a real attack against xAI’s Grok where malicious instructions were hidden as AES-encrypted text on a webpage. When a user asked Grok to summarize the page, Grok decrypted the payload inside its code tool, then followed the now-plaintext instructions to package private session…
Researchers say xAI’s Grok web chat can be manipulated by a poisoned web page so the AI follows hidden attacker instructions. The twist is the instructions are strongly encrypted, so safety scanners don’t recognize them, yet Grok can decrypt and act on them, including leaking a user’s chat details…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers demonstrated a technique that can trick xAI’s Grok into leaking a user’s chat prompts and some session details to an attacker-controlled server when the user asks Grok to summarize a web page. The attack hides malicious instructions inside encrypted content on the page, which Grok is…
Researchers observed real campaigns using compromised WordPress sites to show fake verification/BSOD-style prompts that trick users into running a copied PowerShell command. The technique (ClickFix) was paired with MaaS tools (ErrTraffic and Cruciferra) to deliver malware while attempting to kill…
