Encrypted Prompt Attack Makes Grok Leak User Chats and Personal Data

Summary

Adversa researcher Rony Utevsky found that encrypted prompt injections can make Elon Musk-owned xAI’s Grok expose a user’s name, location and chat history. A malicious webpage supplies ciphertext, plaintext decryption instructions and a key; when asked to summarize the page, Grok processes PBKDF2 and AES-256-GCM, then follows the hidden command. It places the personal data inside a purported decryption key, appends that value to an attacker-controlled URL and opens the link, recording the information in server logs without warning or confirmation. Grok remained vulnerable when Ars Technica published the report on August 20, 2026, despite xAI being informed in June.

Adversa suspects Grok’s static guardrails inspect model inputs and outputs but not results from its code execution sandbox. The classifier therefore accepts an ordinary-looking decryption request but never examines the instructions revealed as tool output. The finding followed a separate attack that used secret input from Microsoft 365 Copilot for enterprise to extract a password from a user’s inbox, underscoring that LLMs cannot reliably distinguish untrusted webpage or email content from user commands.

Adversa calls the technique cryptographic context injection. A related Gemini jailbreak decrypted a fake traceback that told Google’s model to act on an error message, eliciting restricted instructions for building an incendiary weapon and reproducing system instructions that prohibited disclosure. Adversa did not notify Google because jailbreaks fall outside its vulnerability disclosure program. Gemini became more resistant over subsequent weeks, although Adversa could not determine whether filters, model versions or both changed. The firm warns that tool outputs, runtime results and intermediate state create a broader attack surface than conventional model inputs.