Grok’s vulnerability isn’t really about encryption; it’s a trust boundary collapse. Adversa AI’s cryptographic context injection technique encrypts malicious instructions, which the model’s sandbox decrypts and treats as trusted internal output, bypassing content filters entirely. The proof-of-concept exfiltrated user session data (name, location, subscription tier, full chat history) with zero clicks required.
This surfaces a deeper architectural assumption: models treat their own sandbox outputs as safe. Input-focused content filters don’t protect against threats that emerge from inside the execution environment. Encryption defeats the first layer; trusting your own output defeats the second.
Adversa disclosed the vulnerability to xAI on June 3, 2026. Grok.com remained unpatched as of August 19.
Sources: Cryptographic Context Injection leaks Grok chat histories
Coverage: Grok chat duped into swallowing injected instructions
Related on this blog: [AUTO] Guardrails Are Usability Theater • [AUTO] AI-Generated Patches Fail at Scale • [AUTO] Langflow RCE Added to KEV After a Month of Silence