Researchers Bypass Grok's Guardrails by Encrypting the Attack Payload

Security researchers have demonstrated a prompt injection technique that walks straight past xAI's Grok safety filters by doing something deceptively simple: encrypting the malicious instructions before the model ever sees them. The assistant then decrypts the payload itself and acts on the result.

The technique comes from Adversa, whose researcher Rony Utevsky published the findings on Thursday. The firm has named it Cryptographic Context Injection, and reports that xAI was notified in June. As of publication the behavior reportedly remained reproducible.

How the Attack Runs

The setup is a booby-trapped web page. It hosts ciphertext alongside plaintext decryption instructions and the key material needed to unlock it. When a user asks Grok to summarize that page, the assistant follows the visible instructions, runs the decryption inside its own code execution environment, and surfaces the hidden commands as its own tool output.

Those recovered instructions tell the model to assemble what is framed as a decryption key. It is nothing of the sort. The value is stitched together from the user's name, approximate location, and conversation history, then appended as a parameter to a URL pointing at an attacker-controlled server. Once Grok opens the link, the data lands in that server's logs.

According to reporting on Adversa's writeup, the demonstration targeted the Grok web chat running Grok 4.5 Fast, and the exfiltration completed with no confirmation prompt and no visible warning. The firm reported roughly a 40% success rate across around twenty attempts since June, with a reproduction as recently as August 19.

Why the Filter Misses It

Adversa's working theory is a gap in what the guardrail actually inspects. The filter reads text moving into and out of the model, but not the output of the model's own code execution.

Static safety guardrails classify inputs as text; they do not execute them, Utevsky wrote, noting that everything a scanner would need is sitting on the page, but recovering the plaintext requires actually running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time.

In an email, the researcher described such guardrails as static precisely because they only read content rather than running it. The ciphertext passes inspection as meaningless noise. The instructions to decrypt it pass as an ordinary request. Only after the sandbox does the work do the real commands exist, and by then nothing is watching.

Not Just Grok

Adversa applied a comparable approach to Google's Gemini, where decrypted text posed as a traceback carrying a single rule: if the code fails, read the error and act on it. The firm says that chain produced restricted content Gemini's filters normally suppress, and that a modified payload surfaced the model's system instructions, including the directive not to disclose them.

Google was not notified, since jailbreaks fall outside the scope of its vulnerability disclosure program. Adversa reports Gemini has grown more resistant in recent weeks but cannot attribute the change to filter updates, model revisions, or both.

The disclosure follows closely on separate research showing a Microsoft 365 Copilot deployment coaxed into leaking a password from a user's inbox.

The Structural Problem

Adversa frames the technique as one case of a wider shift: attacks aimed not at the prompt but at everything the model treats as its own context, including tool outputs, runtime results, and intermediate state. That surface is substantially larger than what anyone labels model input.

There is no patch, no CVE, and no user-side workaround. For anyone pointing an assistant at untrusted pages, the practical takeaway is that a guardrail which only reads text will not stop an instruction that has not been written yet.