Grok Zero-Click Attack Steals Chat Data Using Encrypted Prompt Injection
Brief
A newly disclosed attack can turn a routine “summarize this page” request in xAI’s Grok web chat into a silent theft of the user’s name, coarse location, subscription tier, and the prompt history of the active conversation.
Adversa AI said in a report shared with Cyber Security News (CSN) that the method, named Cryptographic Context Injection, hides attacker commands inside AES-256-GCM ciphertext so input filters never read them, then induces the model to decrypt and trust those commands as its own code-sandbox output.
Lead researcher Rony Utevsky said the payload sits on an ordinary-looking webpage as an encrypted JSON object, next to key material and a short instruction to decrypt it in the agent’s Python runtime.
Static guardrails classify text; they do not run PBKDF2 and AES-256-GCM.