Adversa Discloses Unpatched Grok Chat Exfiltration Attack
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Adversa AI disclosed an attack it calls 'Cryptographic Context Injection' that exfiltrates a Grok user's name, approximate location, subscription tier, and ongoing conversation prompts to an attacker-controlled server after the user asks Grok to summarize a malicious page, with no confirmation step in its proof-of-concept.
- The exploit reproduced against Grok 4.5 Fast at grok.com on August 19, 2026, with a 40% success rate across 20 attempts since June; failures came from Grok struggling with decryption rather than flagged prompts, and there is no patch, CVE, or user-facing workaround as of August 20.
- The technique bypasses content classifiers because the instructions arrive as ciphertext that Grok's own Python code execution runtime decrypts using PBKDF2 and AES-256-GCM, laundering attacker instructions as model-generated output rather than fetched web content.
- xAI acknowledged Adversa's June 3, 2026 HackerOne report without specifics or a mitigation timeline, then stopped responding after follow-ups on August 4 and August 10, and has not published an advisory; xAI's prior pattern includes closing Johann Rehberger's December 2024 exfiltration chain through Grok in the X iOS app as 'Informational,' a severity call Rehberger publicly disputed.
- The same writeup includes a secondary demonstration against Google Gemini 3 Flash (Web) in Deep Thinking mode that reproduces system instructions and restricted content; Google was not notified because jailbreaks fall outside Adversa's disclosure scope, and the Gemini technique was first published by lead researcher Rony Utevsky on March 11, 2026 as 'Cryptographic Payload Injection' with five of five successes.
- Utevsky said controls must live in the agent harness rather than the model — identity, reach, writes, replay — and noted that OpenAI's GPT-5 failed to parse the decryption instructions while Anthropic's Claude Sonnet 4.5 flagged the payload only after decrypting it.
- Separately, a preprint by Alexander Panfilov and seven co-authors published August 10, 2026 found that encrypted chain-of-thought blocks from Anthropic, OpenAI, and Google are interchangeable across sessions and users, enabling invisible prompt injections inside public agentic rollouts.
Why it matters: Adversa's finding turns an ordinary page-summary request into a one-click data leak for Grok users, and xAI's silence since June leaves teams with no patch or CVE. The technique generalizes across agent runtimes — GPT-5 couldn't parse the ciphertext and Claude flagged it only post-decryption — shifting defense from models to every vendor's harness.
Ask SkimNews
