Research demo
Cryptographic Context Injection: an AES-encrypted web payload decrypted in Grok's code sandbox is treated as trusted and exfiltrates chat history via URL parameters
AIR-2026-0210 AIR record · 2026-08-adversa-cryptographic-context-injection-grok
From the supporting source
In the proof of concept demo, the exfiltration completed with no user confirmation and no visible warning, a true zero-click outcome triggered by an ordinary 'summarize this page' request.adversa.ai
The record
Disclosed
2026-08-20
Vendor
xAI; Google
Product
Grok (web, with browsing and code execution); Google Gemini
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — the agent decrypted the payload in its sandbox and issued the exfiltrating request itself
Attack surface
Consumer assistant
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web page encrypted payload
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Grok users who ask it to summarize an attacker-controlled page; still reproducible against Grok as of 2026-08-19; Gemini success rate had dropped significantly by August 2026
Capability abused
Defense & remediation
Recorded defense
static input guardrails / prompt-injection classifiers on fetched content (bypassed: the payload is ciphertext until the model's own sandbox decrypts it, and the model trusts sandbox output)
Guardrail kinds
Input classifier, Sandbox isolation
Guardrail outcome
Silent
Fix shipped
none for Grok at publication: reported to xAI and HackerOne 2026-06-03, xAI acknowledged with no specifics or timeline, further contacts 2026-08-04 and 2026-08-10 unanswered; Google not formally engaged (jailbreaks out of scope for its program), Gemini success rate dropped by August
Taxonomy & references
Curator notes
Adversa AI (Rony Utevsky), published 2026-08-20. Mechanism: an AES-256-GCM payload with a PBKDF2-derived key sits on a web page; when the user asks Grok to summarize the page, the model decrypts it inside its Python execution runtime, treats the plaintext instructions as its own internal state rather than untrusted content, and invokes its navigation tool to send the user's name, location, subscription tier and full conversation history to an attacker endpoint as URL query parameters. Adversa's framing: static guardrails classify inputs as text and do not execute them, so ciphertext passes. Class research_demo because it is a researcher PoC against live consumer products; no third-party victim. Predates the review window but was a corpus gap (no 'cryptographic' or 'context injection' record before this). autonomy_level=semi_autonomous because the agent chained page fetch, code execution and outbound navigation without per-step approval inside one delegated request; source does not distinguish boundaries precisely.
Supporting sources
Cite as
Enkrypt AI. "Cryptographic Context Injection: an AES-encrypted web payload decrypted in Grok's code sandbox is treated as trusted and exfiltrates chat history via URL parameters". AIR, AIR-2026-0210. https://agentincident.vercel.app/i/AIR-2026-0210/ (accessed 2026-10-19).