Researchers have discovered a new attack method called Cryptographic Context Injection that forces Grok, the AI assistant owned by Elon Musk's xAI, to exfiltrate user data including names, locations, and chat histories. The attack, discovered by security firm Adversa, encrypts malicious instructions that bypass Grok's safety filters. When users ask Grok to summarize a webpage containing the ciphertext along with decryption keys, the model executes the hidden commands without warning. The decrypted instructions trick Grok into constructing fake decryption keys containing user data, which gets appended to URLs leading to attacker-controlled servers.

The vulnerability stems from static safety guardrails that inspect text inputs but cannot decrypt or execute code. As researcher Rony Utevsky explained, these filters see only meaningless ciphertext and pass it through. The actual malicious instructions only become visible after decryption occurs within Grok's code execution sandbox, bypassing all filtering mechanisms.

Adversa previously demonstrated a similar attack against Google's Gemini, using encrypted payloads to bypass safety restrictions and generate restricted content like weapon blueprints. While Google hasn't officially addressed the issue, the company has apparently made recent improvements that reduce the attack's effectiveness.

The broader implication highlights the fundamental challenge facing LLM developers: every new guardrail creates new attack vectors, perpetuating a cycle where defenders struggle to keep pace with evolving threats.