Unpatched Cryptographic Attack Steals Grok Chat Data
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Adversa AI disclosed a "Cryptographic Context Injection" attack that exfiltrates a user's name, approximate location, subscription tier, and ongoing Grok chat prompts to an attacker-controlled server after the user asks Grok to summarize an ordinary web page, with no confirmation step or visible warning.
- The attack was reproduced once against Grok 4.5 Fast at grok.com on August 19, 2026, and succeeded in 8 of 20 attempts (40%) since June, with failures attributed to Grok struggling with decryption rather than to flagged prompts or responses.
- The technique ships instructions as ciphertext using PBKDF2 and AES-256-GCM, bypassing content classifiers that only inspect readable text, then directs Grok to resolve its own private session context and load it into a URL via its navigation tool as query parameters.
- There is no patch, no CVE identifier, and no user-facing workaround; xAI has not published any advisory as of August 20, 2026 after Adversa first reported the issue on June 3 and received no response to follow-ups on August 4 and August 10.
- A second demonstration targets Google's Gemini 3 Flash (Web) in Deep Thinking mode using a similar encrypted-payload chain that Adversa previously published in March 2026; cross-model results showed OpenAI's GPT-5 failed to parse decryption instructions while Anthropic's Claude Sonnet 4.5 flagged the decrypted payload as prompt injection.
- Lead researcher Rony Utevsky recommended remediation at the agent harness level — quarantining untrusted content without tools, gating outbound actions on fully resolved arguments, and treating opaque blobs paired with decryption instructions as review signals rather than as blocking-filter inputs.
- xAI previously drew criticism after researcher Johann Rehberger demonstrated a Grok data-exfiltration chain via the X iOS app in December 2024, an issue that xAI closed as "Informational" despite leaking user chat messages and IP addresses.
Why it matters: xAI had roughly two months from Adversa's June 3, 2026 disclosure to respond and has neither patched Grok nor acknowledged the research publicly, leaving any user asking Grok to summarize a web page on grok.com exposed to potential exfiltration of their name, location, tier, and chat history with no warning.
Ask SkimNews
