Grok Exposes Chat Data Through Encrypted Prompt Injection

According to Adversa lead researcher Rony Utevsky, quoted by The Register, the attack requires the model to run PBKDF2 and AES-256-GCM inside its code-execution sandbox to recover the plaintext. A conventional content scanner cannot inspect the encrypted payload merely by reading the page, even though the decryption key and code are present there.

The Hacker News reports that Grok's Python code-execution runtime decrypts the JSON payload, after which the resulting instructions direct the agent to resolve private session context and place it in a URL. Grok's navigation tool then loads that URL, exposing the data through query parameters in the request.

This distinction matters technically because it shifts the malicious instruction from fetched page content to output created by the model's own execution environment. The Register characterizes that transition as "trust laundering": the model processes its decrypted output as trusted context despite its untrusted origin.

Adversa told The Hacker News it attempted the attack 20 times since June and observed a 40% success rate. The company attributed failures to Grok's inability to complete decryption rather than to safety filters blocking the prompt or response. The writeup did not provide a broader success-rate study, report exploitation in the wild, or assign a CVE identifier.

Ars Technica reported that xAI had been informed about the issue in June and that Grok continued to return data when Ars published its report on August 20. The Hacker News similarly reported no patch or user-facing workaround at the time of publication.

The case extends a familiar prompt-injection problem: models often cannot reliably distinguish user-authorized instructions from text supplied by an untrusted webpage, email, or document. Here, strong encryption adds a runtime step that static inspection systems may not emulate.

For teams building browser-enabled or code-executing agents, comparable attacks illustrate why input filtering alone is insufficient when models can decrypt payloads and invoke navigation tools. Common defensive patterns in similar systems include isolating untrusted content, treating runtime-produced text as untrusted when it derives from external inputs, restricting access to sensitive session data, and requiring explicit authorization before an agent sends data to external domains. Those controls do not eliminate prompt injection, but they can reduce the consequences of a successful instruction-following failure.

The reported proof of concept is specifically about Grok web chat, not a demonstrated vulnerability across all LLM applications. Its broader relevance is the combination of page summarization, code execution, private context, and outbound network access, capabilities increasingly bundled into agentic AI products.