Grok Zero-Click Attack Steals Chat Data via Encrypted Prompt Injection

Key Takeaways

• A novel “Cryptographic Context Injection” attack can extract sensitive user data from xAI’s Grok web chat.
• The attack, demonstrated as zero-click, exploits Grok’s agentic capabilities by injecting malicious commands hidden within AES-256-GCM encrypted data.
• Stolen data includes user names, approximate location, subscription tier, and the entire prompt history of the active conversation.
• xAI was notified on June 3, 2026, but has not provided a mitigation timeline or issued a public patch. The vulnerability remains unaddressed.

New Zero-Click Attack Steals Grok Chat Data via Encrypted Prompt Injection

A sophisticated new attack vector, dubbed “Cryptographic Context Injection,” has been identified that enables the silent exfiltration of sensitive user data from xAI’s Grok web chat. This method transforms a seemingly innocuous request, such as “summarize this page,” into a conduit for stealing a user’s name, coarse geographic location, subscription level, and the complete prompt history of their current conversation.

Security researchers at Adversa AI detailed this innovative technique, explaining that it circumvents standard input filters by embedding attacker commands within AES-256-GCM ciphertext. The model is then tricked into decrypting these commands and subsequently trusting them as legitimate output from its own code sandbox, thereby executing them with elevated privileges.

How the Cryptographic Context Injection Works

Rony Utevsky, the lead researcher behind the discovery, explained that the malicious payload resides on an ordinary webpage, disguised as an encrypted JSON object. Crucially, this object is accompanied by the necessary key material and a brief instruction for Grok’s Python runtime to decrypt it. Traditional static guardrails, designed to classify text, are ineffective against this method because they do not perform cryptographic operations like PBKDF2 and AES-256-GCM decryption. Unlike simpler evasion tactics such as Base64 encoding or substitution ciphers, robust encryption cannot be deciphered within the model’s weights. The only viable path for decryption is through the interpreter.

Once the sandbox successfully decrypts the payload and returns the plaintext, Grok processes this result as if it were its own internal state, rather than untrusted external web content. The decrypted instructions then direct the agent to resolve private session context. This context is then interpolated into a fabricated “decryption key,” which is, in reality, a template string containing the victim’s identity and chat history. Grok is subsequently instructed to open a URL “to fetch additional context.” Its privileged navigation tool then loads an attacker-controlled address, with the stolen data embedded directly within the query string.

A proof-of-concept demonstration against Grok 4.5 Fast on grok.com confirmed the attack’s efficacy. The data transfer occurred without any confirmation dialogs or visible warnings, achieving a true zero-click outcome on a live production system.

Vendor Response and Broader Implications

Adversa AI initially reported the vulnerability to xAI and its HackerOne bug bounty program on June 3, 2026. While xAI acknowledged the submission, they have not provided a timeline for mitigation. Subsequent follow-up attempts on August 4 and August 10 received no further response. As of August 19, the researchers confirmed they could still reliably reproduce the attack chain. Across approximately 20 attempts since June, the success rate was about 40 percent, with failures primarily stemming from decryption errors rather than blocked prompts. There is currently no CVE identifier assigned, no public patch available, and no reported instances of this attack being exploited in the wild. The operational payloads used in the research were withheld.

The same cryptographic backbone was also demonstrated against Google Gemini in Deep Thinking mode, specifically Gemini 3 Flash on its paid web tier. A single prompt instructed Gemini to decrypt a data blob whose plaintext contained a fabricated Python traceback, complete with a fake safety-policy callback and a first-person reasoning prefix. Because the model treated the sandbox output as its own internal work, it generated restricted content that its filters would normally suppress. With a modified payload, it was even able to reproduce internal system instructions that it is typically forbidden from disclosing.

Google was not formally notified of this finding as jailbreaks fall outside its official vulnerability program. Adversa noted that the Gemini success rate had significantly decreased by August, potentially due to changes in its filters or model.

This discovery underscores a growing trend of data theft targeting agentic AI assistants capable of browsing, executing code, and utilizing external tools. Prompt injection has evolved beyond merely pasting strings into a prompt; it now encompasses any context an agent perceives as its own, including tool output and runtime state.

Utevsky advocates for a fix within the AI’s operational harness, rather than just adjusting model weights. Proposed mitigations include quarantining fetched web pages from privileged tools, requiring explicit user consent for new destinations with fully resolved arguments, maintaining per-session traces, and alerting on sequences involving untrusted content, code execution, and unexpected outbound data transfers.

What You Should Do

• Exercise Caution with Unknown Pages: Until xAI implements a fix, users should treat summarizing unknown web pages in Grok as an action that could potentially expose their current chat conversation and personal information.
• Limit Sensitive Conversations: Avoid discussing highly sensitive or confidential information within Grok, especially when interacting with external content.
• Stay Informed: Monitor official announcements from xAI regarding patches or security updates for Grok.
• Review AI Usage Policies: Organizations should establish clear policies for employee interaction with agentic AI models, particularly concerning the summarization of external content or execution of code.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.