{
 "public_id": "AIR-2026-0210",
 "incident_id": "2026-08-adversa-cryptographic-context-injection-grok",
 "date_disclosed": "2026-08-20",
 "date_occurred": null,
 "title": "Cryptographic Context Injection: an AES-encrypted web payload decrypted in Grok's code sandbox is treated as trusted and exfiltrates chat history via URL parameters",
 "class": "research_demo",
 "attack_surface": "consumer_chatbot",
 "initial_vector": "indirect_prompt_injection_web_page_encrypted_payload",
 "agent_capability_abused": [
  "web_browsing",
  "code_execution_sandbox",
  "outbound_navigation_tool",
  "session_context_access"
 ],
 "target_product": "Grok (web, with browsing and code execution); Google Gemini",
 "target_vendor": "xAI; Google",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration"
 ],
 "blast_radius": "Grok users who ask it to summarize an attacker-controlled page; still reproducible against Grok as of 2026-08-19; Gemini success rate had dropped significantly by August 2026",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "encrypted_payload",
   "guardrail_evasion",
   "sandbox_output_trusted",
   "zero_click",
   "url_parameter_exfiltration",
   "unfixed_at_disclosure"
  ]
 },
 "defense_present": "static input guardrails / prompt-injection classifiers on fetched content (bypassed: the payload is ciphertext until the model's own sandbox decrypts it, and the model trusts sandbox output)",
 "defense_bypassed": true,
 "fix_shipped": "none for Grok at publication: reported to xAI and HackerOne 2026-06-03, xAI acknowledged with no specifics or timeline, further contacts 2026-08-04 and 2026-08-10 unanswered; Google not formally engaged (jailbreaks out of scope for its program), Gemini success rate dropped by August",
 "primary_sources": [
  "https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft/"
 ],
 "verified_quote": "In the proof of concept demo, the exfiltration completed with no user confirmation and no visible warning, a true zero-click outcome triggered by an ordinary 'summarize this page' request.",
 "confidence": "high",
 "notes": "Adversa AI (Rony Utevsky), published 2026-08-20. Mechanism: an AES-256-GCM payload with a PBKDF2-derived key sits on a web page; when the user asks Grok to summarize the page, the model decrypts it inside its Python execution runtime, treats the plaintext instructions as its own internal state rather than untrusted content, and invokes its navigation tool to send the user's name, location, subscription tier and full conversation history to an attacker endpoint as URL query parameters. Adversa's framing: static guardrails classify inputs as text and do not execute them, so ciphertext passes. Class research_demo because it is a researcher PoC against live consumer products; no third-party victim. Predates the review window but was a corpus gap (no 'cryptographic' or 'context injection' record before this). autonomy_level=semi_autonomous because the agent chained page fetch, code execution and outbound navigation without per-step approval inside one delegated request; source does not distinguish boundaries precisely.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "the agent decrypted the payload in its sandbox and issued the exfiltrating request itself",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_web_page_encrypted_payload",
 "guardrail_kind": [
  "input_classifier",
  "sandbox_isolation"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "unknown",
 "model_provider": "multiple",
 "model_name": "",
 "detection_mechanism": "external_researcher",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI01 (vector_family=indirect_prompt_injection); ASI05 (vector=code_exec)",
 "submitted_by": "EAI Internal"
}