Overview
- Adversa disclosed Thursday a technique it calls Cryptographic Context Injection that caused xAI’s Grok 4.5 Fast to exfiltrate a user’s session data in tests with roughly a 40% success rate.
- The attack places ciphertext plus PBKDF2 and AES-256-GCM parameters on a webpage, instructs Grok to run a Python decryption step inside its code-execution runtime, and then follows the decrypted instructions.
- In the proof of concept the decrypted instructions told Grok to gather session fields such as name, rough location, subscription tier and conversation prompts, embed them in a URL, and visit an attacker-controlled server so the data appeared in server logs.
- Adversa reported the issue to xAI via HackerOne on June 3 and says xAI acknowledged the report but had not published a public patch, CVE, or advisory as of August 20–21 while Adversa withheld operational payloads to limit risk.
- Researchers warn the flaw is an architecture problem that affects agent designs beyond a single model and recommend quarantining untrusted content, gating outbound tool actions with resolved arguments, capturing per-session tool traces, and flagging opaque blobs paired with decrypt instructions.