# Grok Attack Exploits Encrypted Prompts for Data Theft

*Published August 24, 2026*
*Source: [https://cybersecuritynews.com/grok-zero-click-attack/](https://cybersecuritynews.com/grok-zero-click-attack/)*

## Executive Summary

A new attack method called Cryptographic Context Injection allows attackers to steal user data from xAI's Grok web chat by embedding encrypted commands. The vulnerability remains unaddressed, posing a risk for data theft without user interaction.

## Article

A recently uncovered attack method allows for the covert theft of user data during routine interactions with xAI's Grok web chat. This method, known as Cryptographic Context Injection, exploits the model by embedding malicious commands within AES-256-GCM encrypted data. These commands are disguised so effectively that input filters do not detect them, deceiving the model into decrypting and executing them as its own instructions.

According to Adversa AI's report, the attack payload is embedded in a seemingly innocent webpage. It comprises an encrypted JSON object alongside key material and a brief decryption instruction, ready for execution in the agent's Python runtime. Unlike previous evasion tactics, this technique leverages strong encryption, which cannot be retrieved from the model's weights, making the interpreter the sole execution pathway. Once decrypted, the instructions manipulate the model to extract and transmit sensitive user data, such as names and chat histories, to an attacker-controlled URL.

In a demonstration using Grok 4.5 Fast, the attack completed without any user interaction or warnings, achieving a true zero-click compromise. Despite Adversa AI reporting this issue to xAI and its HackerOne program on June 3, 2026, no mitigation has been implemented, and the flaw remains exploitable. Tests conducted up to August 19 showed a 40 percent success rate, with failures attributed to decryption errors.

The same cryptographic vulnerability was tested against Google Gemini, demonstrating similar vulnerabilities in its Deep Thinking mode. Although Google was not notified due to the nature of jailbreaks, the success rate against Gemini decreased, possibly due to changes in its filtering or model settings. This discovery highlights a broader trend of data theft from intelligent assistants capable of browsing and executing code. The solution, according to lead researcher Rony Utevsky, involves isolating fetched pages, requiring user consent for new actions, and monitoring for untrusted content.

Users of Grok are advised to remain cautious when summarizing unfamiliar web pages, as this action can inadvertently expose chat data.