Cryptographic Context Injection: Encrypted Prompt Injection Against Grok and Gemini
Cryptographic Context Injection is Adversa AI's name for an indirect prompt injection whose payload no scanner in the path can read. In research by Rony Utevsky published 20 August 2026, attacker commands ship as cryptographically secure ciphertext and the model is induced to decrypt them inside its own code execution runtime. No CVE identifier had been reported as of 20 August 2026, no patch announced, no exploitation in the wild reported.
The payload is AES-256-GCM ciphertext under a PBKDF2-derived key, shipped on the page beside the key material and an instruction to decrypt it. Recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. AES is not weakened; the failure is a harness that trusts its own sandbox output.
Adversa credits prior art on two fronts. CipherChat and CodeChameleon carried payloads past alignment with weak, reversible schemes - substitution ciphers, reordering, XOR, base64 - that a model decodes natively, no interpreter in the loop; against them Adversa claims strong encryption cannot be decoded in-weights at all, forcing recovery through the runtime. It separately credits Johann Rehberger for exfiltration through a code interpreter's outbound request since 2023; there the claim is not the egress but that instructions arrive as the return value of the agent's own decryption run, not as fetched text a filter could inspect.
What happened: Cryptographic Context Injection against Grok
The Grok target is xAI's web chat with agentic browsing, reached through the browsing channel: a user asks Grok to summarize a page carrying the ciphertext, key material and instructions. The model decrypts in its own runtime, so the plaintext returns not as fetched web content but as something the model produced itself. Adversa's summary: "The code execution runtime is a trust laundering channel".
In the proof of concept the agent folded the user's name, coarse location, subscription tier and prompt history into a URL, then opened it with its own privileged navigation tool - the outbound path examined in browser AI security risks and controls. The disguise was a second decryption key that was really a template string interpolating that context, and Adversa reports no confirmation prompt or visible warning.
Adversa's read of the framework, not xAI's, is that it enforces no effective egress boundary or consent gate on this path, and no provenance separation the researchers could observe. That second half is the SQL injection failure mode: data and instructions share one channel.
On status, Adversa's post says the issue is "still unfixed"; its only date-anchored evidence is one line: "As of August 19, we could still reproduce the attack against Grok." Two much-repeated details - Grok 4.5 Fast at grok.com and 20 attempts since June at a 40% success rate - come from Adversa's remarks to reporters, not its post.
The Gemini case is a policy bypass, not a data leak
The second target differs in kind: Gemini's public chat in Deep Thinking mode, self-identified in the extracted system instructions as Gemini 3 Flash (Web), paid tier, not confirmed by Google. The injection is direct: one prompt asks Gemini to decrypt a ciphertext in Python, and the plaintext is a fabricated traceback whose API-styled callback appears to deactivate the safety policy. No user data was exfiltrated. A bypass producing only restricted text still matters where an agent then acts on it - the pattern behind ShareLeak and PipeLeak.
The Gemini half is also not new to August. The Hacker News reports that Utevsky published substantially the same chain on 11 March 2026 as Cryptographic Payload Injection, quoting him that this part of the research "was conducted in March and has undergone no substantial changes". Nor is it model-independent: Adversa notes success rates vary by target, and reporters found GPT-5 failed to parse the decryption instructions while Claude Sonnet 4.5 flagged the decrypted payload as prompt injection.
| Dimension | Grok case | Gemini case |
|---|---|---|
| Injection path | Indirect, via agentic browsing | Direct, in the user's own prompt |
| Outcome | Name, coarse location, tier and prompt history sent to an attacker URL | Restricted content and system instructions reproduced; no data loss |
| Disclosure | xAI and HackerOne, 3 June 2026; acknowledged, no timeline; still reproducible 19 August | First published 11 March 2026; never disclosed, jailbreaks out of scope for Google |
Why Cryptographic Context Injection is an agentic-endpoint risk
Content filtering is the wrong layer here: the payload is unreadable to every scanner in the path by construction, and the agent's own sandbox is the decryption oracle. That is the failure argued in why regex-era DLP fails on prompts and MCP calls, and it marks where scan-time vetting ends and runtime governance begins.
The control is provenance, not pattern matching. GhostSplice made a refused instruction unreadable by splitting it across three MCP channels, and memory poisoning is the same move on a longer clock.
On Adversa's reading, chat agents now hold the lethal trifecta by default: untrusted content, private data in context, a privileged outbound tool, which is exactly the Grok chain. For coding and platform-operations agents it is worse: code execution is the product, not an exception path. Every control Adversa proposes sits in the harness, not the model layer, though it also markets its own platform there.
- Quarantine untrusted content in a context with no tools and no credentials - the isolation half of the containment gap.
- Gate irreversible and outbound actions with a confirmation showing fully resolved arguments; hard-deny where no human is present.
- Capture per-session tool traces with resolved arguments, as in building an audit trail for AI agents.
- Alert on the sequence, not one payload - the baseline in runtime monitoring for AI agents.
How Anomity surfaces the preconditions for Cryptographic Context Injection
Anomity collects metadata only - never source code, prompts, or secret values - so it would not have read this ciphertext or stopped the Grok exfiltration, which ran inside xAI's cloud. It governs the endpoints you manage: the unprivileged Endpoint Sensor inventories eight AI artifact types per endpoint - AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, and CLIs - turning Adversa's precondition set into one query. Which agents hold code execution, browsing, and reachable credentials at once? Start with how to build an AI agent inventory.
Then decide at the hook, where one exists - Claude Code's PreToolUse event, explained in how Claude Code hooks work. Anomity returns allow, deny, or log before the call runs, and an outbound call to a host outside the declared dependency graph is denied on the destination alone, without reading the payload. An agent with no hook gets inventory, not enforcement.
Every added, changed or removed artifact then lands in a queryable 90-day audit trail, so "was this agent capable of that chain, and since when?" becomes answerable. Findings route to SIEM, Slack, email or Jira; Anomity is SOC 2 Type II and complements rather than replaces Network, EDR, DLP and GRC.
You can't govern what you can't see.The Anomity principle
What to check across your fleet
- List every agent on managed endpoints holding code execution, network fetch and credentials at once - Adversa's precondition set.
- Identify which of those can be steered by content they fetch, not only by the user's prompt.
- Constrain agent-initiated outbound requests to a host allowlist; the Grok chain left through the agent's own navigation tool.
- Confirm tool logs record resolved arguments, not templates; a URL logged before interpolation hides the data that left.
- Do not block encrypted or high-entropy content; Adversa calls that a review signal, not a filter. Alert on the decrypt-then-act sequence.
Cryptographic Context Injection breaks neither AES nor a model. It breaks the assumption that a scanner in front of an agent can see what the agent will act on. The useful move is knowing which of your agents hold code execution, browsing and credentials at once. Book a demo to see that inventory.
Related
- Indirect prompt injection explained - the parent pillar for this channel
- The lethal trifecta in production - the same shape in shipped products
- GhostJacking - hijacking agents through actions they already may take
- Securing computer-use and browser agents - controls for agents that fetch and act
- Securing AI coding agents and CLIs - the population Adversa says is most exposed
Frequently asked questions
What is Cryptographic Context Injection?
It is the name Adversa AI gave, in research by Rony Utevsky published on 20 August 2026, to a prompt injection technique that ships attacker instructions as AES-256-GCM ciphertext under a PBKDF2-derived key, alongside the key material and an instruction to decrypt. Content scanners see only ciphertext, because recovering the plaintext means running PBKDF2 and AES-256-GCM, which no classifier does at inspection time. Adversa's key claim is that strong encryption cannot be decoded in-weights at all, so recovery is forced through the code execution runtime. The model then treats its own sandbox output as internal state rather than as untrusted input, which is where the trust is laundered.
Is Grok vulnerable now, and is there a CVE?
No CVE identifier had been reported as of Adversa's 20 August 2026 publication, no public patch has been announced, and no exploitation in the wild has been reported. The only date-anchored statement on current status is Adversa's own: as of 19 August 2026 it could still reproduce the attack against Grok. That is a reported status on a specific date, not a verified statement about the product today. Adversa reported the issue to xAI and to xAI's HackerOne program on 3 June 2026, says xAI acknowledged it without specifics or a mitigation timeline, and says follow-up contact on 4 and 10 August 2026 received no response. Operational payloads were withheld.
How is the Gemini finding different from the Grok finding?
They are different failures and should not be summarized together. The Grok case is indirect injection through the agentic browsing channel that ended in data exfiltration: Adversa reports the agent resolved the user's name, coarse location, subscription tier and prompt history into a URL and opened it with its privileged navigation tool. The Gemini case is direct injection in the user's own prompt, in Deep Thinking mode, and is a safety-policy bypass plus system-instruction extraction with nothing exfiltrated. It is also the older half: The Hacker News reports that Utevsky published substantially the same chain on 11 March 2026 as Cryptographic Payload Injection. It was never disclosed to Google, since jailbreaks are out of scope for that program.
Should we block encrypted or high-entropy content reaching our agents?
Adversa says no, and the reasoning holds. An opaque blob paired with instructions to decrypt it is, in its words, a review signal and never a blocking filter. Legitimate content is full of high-entropy strings, so a blocking rule generates noise while remaining trivially evadable. The detection unit is the chain rather than the payload: untrusted content enters context, code executes, then the agent contacts a host outside its dependency graph or writes outside declared scope. That is a sequence-level alert, matching Adversa's recommendation to alert on the sequence rather than one payload, and it belongs alongside per-session tool traces that record fully resolved arguments rather than templates.
What can Anomity actually do about this?
Not much at the model layer. The decryption happened inside xAI's cloud, where Anomity has no telemetry, and it reads metadata rather than payloads, so it would never have seen the ciphertext. The useful ground is earlier. Adversa's preconditions are properties of an endpoint, and an inventory that already tracks which agents and MCP servers are installed can answer whether any of them combine code execution, network fetch and reachable credentials before an attacker asks the same question. Where the agent exposes an enforcement hook, that answer becomes a deny on the destination rather than a report after the fact. Where it does not, you still get change detection and a record you can query later.
