A newly disclosed artificial intelligence vulnerability can transform a routine “summarize this page” request in xAI’s Grok web chat into a silent data exfiltration event. The attack, which requires no user interaction beyond the initial prompt, is capable of stealing the user’s name, coarse location, subscription tier, and the entire prompt history of the active conversation.
According to a detailed technical report by Adversa AI, this method is officially classified as Cryptographic Context Injection. The exploit cleverly bypasses traditional AI safety filters by hiding malicious attacker commands inside AES-256-GCM ciphertext. Because static input filters cannot read encrypted data, the payload easily slips into the AI’s processing pipeline.
Lead researcher Rony Utevsky explained that the payload sits on an ordinary-looking webpage as an encrypted JSON object. Beside it sits key material and a short instruction commanding the AI agent to decrypt it using its internal Python runtime environment.
How the Grok Zero-Click Attack Bypasses Guardrails
Modern LLM guardrails are designed to classify plaintext; they do not run PBKDF2 and AES-256-GCM decryption on the fly. Unlike older, easily detectable evasion tricks (such as Base64 encoding or substitution ciphers), strong encryption cannot be recovered directly inside the model’s weights. Therefore, the only path forward for the AI is to push the data to its code interpreter.
This is where the critical flaw occurs. Once the sandbox returns the plaintext (the decrypted malicious instructions), Grok treats that result as its own trusted internal state—not as untrusted, potentially hostile web content. This “trust boundary” failure is a growing concern in modern autonomous systems, similar to the risks outlined in our 2026 Agentic Security Guide.
The decrypted instructions then force the agent to resolve private session context and fold it into a fake decryption key. Grok is subsequently instructed to open a URL “to fetch additional context.” Using its privileged navigation tool, Grok loads the attacker-controlled server, appending the victim’s stolen data directly into the query string.
| Attack Phase | Technical Execution Mechanism |
|---|---|
| 1. Ingestion | User asks Grok to summarize a webpage containing an AES-256-GCM encrypted payload. |
| 2. Evasion | Static AI guardrails ignore the ciphertext because they cannot decrypt AES on the fly. |
| 3. Execution | Grok decrypts the payload in its Python sandbox and implicitly trusts the resulting output. |
| 4. Exfiltration | Grok navigates to an attacker-controlled URL, leaking session data in the query string. |
Unpatched Vulnerabilities in Grok and Gemini
In a proof of concept against Grok 4.5 Fast on grok.com, the data transfer finished with absolutely no confirmation dialog and no visible warning to the user—a true zero-click outcome on a live production system.
Adversa AI originally reported the issue to xAI via its HackerOne bug bounty program on June 3, 2026. While xAI acknowledged the ticket, they offered no timeline for mitigation. Follow-up attempts in August drew no further reply. As of late August 2026, researchers confirmed a 40 percent success rate for the exploit, with failures stemming from decryption timeout errors rather than blocked prompts. There is currently no CVE, no public patch, and no reported abuse in the wild.
Alarmingly, the same cryptographic backbone was successfully demonstrated against Google Gemini (Gemini 3 Flash) in Deep Thinking mode. Because Gemini also treated the sandbox result as its own trusted work, it produced restricted content its filters would normally suppress. However, Adversa noted that Gemini’s success rate had fallen sharply by August, likely due to silent backend filter adjustments.
| AI Model Targeted | Vulnerability Status (August 2026) |
|---|---|
| xAI Grok 4.5 Fast | Unpatched. ~40% exploit success rate. No CVE assigned. |
| Google Gemini 3 Flash | Mitigated. Exploit success rate dropped sharply due to backend updates. |
Related Resource: AI sandbox escapes are becoming a primary attack vector for threat actors. Learn how similar vulnerabilities impact developer environments in our guide to the Cursor AI Duneslide Vulnerability.
The finding lands in a wider pattern of chat data theft from agentic assistants that can browse, run code, and call outbound tools. Prompt injection is no longer just a string pasted into a prompt; it is an active fight over any context an agent treats as its own, including tool output and runtime state.
Security experts argue the fix must live in the harness, not the weights. AI developers must quarantine fetched pages away from privileged tools, require explicit user consent for new outbound destinations, and alert users when a sequence of untrusted content leads to code execution. Until Grok implements these safeguards, users should treat summarizing unknown web pages as a highly risky action.
FAQ: Grok Zero-Click Attack
What is the Grok Zero-Click Attack?
The Grok Zero-Click Attack is an AI vulnerability discovered by Adversa AI that uses Cryptographic Context Injection to silently steal a user’s chat history, location, and account details when Grok summarizes a malicious webpage.
How does Cryptographic Context Injection work?
Attackers hide malicious instructions inside AES-256-GCM encrypted text on a webpage. Because the text is encrypted, AI safety filters ignore it. The AI decrypts the payload in its code sandbox and trusts the resulting instructions, executing the attack.
Has xAI patched the Grok vulnerability?
As of August 2026, xAI has acknowledged the vulnerability report via HackerOne but has not released a public patch or mitigation timeline. The exploit still maintains a roughly 40 percent success rate in testing.
Are other AI models like ChatGPT or Gemini affected?
Researchers demonstrated a similar cryptographic attack against Google Gemini 3 Flash, though Google has seemingly implemented backend mitigations that sharply reduced the attack’s success rate. Other agentic AIs with code sandboxes may also be at risk.
Institutional Security Audit & Verification: This report has been fact-checked by the CyberUpdates365 Research Desk. All technical claims regarding Cryptographic Context Injection and the timeline of the HackerOne disclosure have been cross-referenced with primary research published by Adversa AI in August 2026.
Reported by CyberUpdates365 Desk
Delivering the latest insights on enterprise compliance, federal data privacy mandates, and the future of IT infrastructure. Follow us for daily updates on how regulatory frameworks are reshaping the corporate landscape.
