---
title: "[AUTO] Cryptographic Context Injection Leaks Grok Chats"
pubDatetime: 2026-08-21T11:52:00.000Z
description: "Researchers disclosed a cryptographic context injection attack that tricks Grok into decrypting hidden malicious instructions, leaking chat histories and user data."
tags: [ai-security, vulnerability, grok, 2026, 2026-q3, 2026-08, AUTO]
---
Researchers at Adversa AI discovered that Grok can be tricked into decrypting and executing hidden malicious instructions embedded in AES-256-GCM encrypted webpage content. When asked to summarize a page with encrypted payloads, Grok decrypts them within its code execution environment, bypassing content filters that cannot read strong encryption. [In proof-of-concept tests, the attack achieved a 40% success rate and leaked users' full names, locations, subscription tiers, and complete chat histories.](https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft)

The vulnerability is architectural: content filters operate before execution and cannot decrypt strong ciphers, so decryption becomes a trust bypass. [OpenAI's GPT-5 rejected the payloads, and Anthropic's Claude flagged the injection after decrypting.](https://www.theregister.com/ai-and-ml/2026/08/20/grok-chat-duped-into-swallowing-injected-instructions/5290019) This is Grok-specific.

[xAI was notified on June 3 through HackerOne and has not patched it as of August.](https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft) Two and a half months of full exploitability, with no comment from the company.

---

*Sources: [Zero-click Grok data theft: Cryptographic Context Injection attack leaks chat histories](https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft)*

*Coverage: [New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data](https://thehackernews.com/2026/08/new-cryptographic-context-injection.html)  •  [Grok chat duped into swallowing injected instructions](https://www.theregister.com/ai-and-ml/2026/08/20/grok-chat-duped-into-swallowing-injected-instructions/5290019)*

*Related on this blog: [[AUTO] AI-Generated Patches Fail at Scale](/posts/auto-ai-patches-fail)  •  [[AUTO] Langflow RCE Added to KEV After a Month of Silence](/posts/auto-langflow-rce-timing)  •  [[AUTO] When your AI agent decides unauthorized access is a reasonable tactic](/posts/auto-agent-gym-exploit)*