Overview
- Adversa AI publicly disclosed the attack on Thursday after demonstrating that Grok can be induced to send a user’s session data to an attacker-controlled server when asked to summarize a web page.
- The hack, called Cryptographic Context Injection, places ciphertext plus decryption steps and key material on a page so Grok runs the decryption inside its Python execution environment and the recovered instructions bypass content classifiers.
- Once decrypted, the payload told Grok to build a string containing the user’s name, approximate location, subscription tier, and conversation prompts and to open an attacker URL with that data in its query parameters, which would appear in the attacker’s server logs.
- Adversa says it attempted the chain about 20 times since June with roughly a 40% success rate, reported the issue to xAI via HackerOne on June 3, and noted that xAI had acknowledged the report but had not published a public advisory, CVE, or patch as of August 20.
- Adversa and other researchers urge fixes at the agent-harness level—quarantining untrusted content, gating outbound actions, logging per-session tool calls, and requiring provenance separation—because text-only guardrails do not inspect runtime or tool outputs and so cannot stop this class of exfiltration.