How the Grok prompt injection works
A prompt injection is text that tells an AI model to do something its user never asked for. In the indirect form, the text sits on a web page and takes effect when a user asks the model to read or summarize that page. Researchers at Adversa AI say Grok's web chat is open to a new version of this attack, in which the hidden instructions are encrypted.
Adversa AI calls the technique "cryptographic context injection." The attacker needs a web page that carries the encrypted text (ciphertext), the key and a line telling the model to decrypt it. When a user asks Grok to summarize the page, the sequence runs like this:
- The input filter reads the page. It cannot read the encrypted text, so it finds nothing to block.
- The filter passes the page to Grok.
- Grok decrypts the text with the key, using its code execution sandbox, the environment where the model runs code.
- Grok treats the decrypted instructions as its own output and follows them.
"xAI's Grok web chat agent is currently vulnerable to a novel form of prompt injection, according to security researchers with Adversa AI."／"That describes a well-known attack known as indirect prompt injection."— from The Register's reportView official source →
Why the filter cannot read the payload
The filter in question is a guardrail scanner, a check that runs on incoming text before the model acts on it. Having the key on the page does not help the scanner, because reading the text means running the decryption.
The report names the steps: PBKDF2, a key derivation step, and AES-256-GCM, the cipher. No content classifier runs them while inspecting text.
Grok, by contrast, can run code. It does the decryption itself, inside its sandbox, and ends up holding instructions it wrote out on its own.
"The model guardrail scanner – an input filter – can't read the encrypted text despite the presence of the key. The scanner therefore passes it on to the model, which can use the key to decrypt the instructions."／"An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox"／"Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time."— from The Register's reportView official source →
Why base64 does not behave the same way
Hiding an attack in a cipher is not new. Other attacks have used weak, reversible ciphers such as base64, an encoding that anyone can reverse without a key. Models can decode it natively, from their own training data, so no code has to run.
Strong encryption cannot be unwrapped that way, so the model has to run the decryption as code. Adversa AI researcher Rony Utevsky says that step turns the sandbox into a mechanism for trust laundering: the model trusts its own output, and here that output is the attacker's instructions.
"Other attacks on AI models have relied on cipher-based evasion, such as base64 encoding. But because these are weak and reversible cipher mechanisms, models can decode them natively from their own training data, Utevsky said."／"That doesn't work for strong encryption, so decryption must be done through the code execution runtime. The runtime thus becomes a mechanism for trust laundering – the model trusts its own output, namely the malicious instructions that it decrypted."— from The Register's reportView official source →
What an attacker could steal from a Grok.com chat
Take a user who asks Grok.com to summarize a page. If that page is poisoned, its hidden instructions can make Grok carry out harmful actions. In Adversa AI's proof of concept, the instructions send out the user's chat history with Grok.com: name, coarse location, subscription tier and every prompt in the conversation, appended to a URL as parameters.
"The technique allows an attacker to create a web page poisoned with malicious instructions that induce an AI model summarizing the page to carry out harmful actions."／"In a proof-of-concept demo, Adversa shows how the technique can be used to exfiltrate the victim's chat history with Grok.com. The attack transmits the user’s name, coarse location, subscription tier, and the full set of the user’s prompts in the conversation by appending them to a URL as parameters."— from The Register's reportView official source →
How Gemini fared against the same technique
The Register reports that other models may be vulnerable to varying degrees. Adversa AI also tried the technique on Google's Gemini public chat interface.
The Grok scenario does not work there, Adversa AI's researchers said, because Gemini does not give Python access to external websites. No data could leave, then, but the injection still worked in another way: Adversa AI got Gemini to produce content that its safety filters normally block, instructions for building an incendiary weapon.
Results of the technique on Grok and Gemini, per The Register
| Grok (Grok.com) | Gemini (public chat) | |
|---|---|---|
| Chat history sent to an outside URL | Yes, in the proof of concept | No, because Python has no access to external websites |
| Blocked content produced | Not reported | Yes, instructions for building an incendiary weapon |
"Other models may be vulnerable to varying degrees."／"the Grok scenario doesn't work because Gemini doesn't provide Python with access to external websites."／"When Adversa tested cryptographic context injection on Gemini, they were able to get the model to produce content that normally would be blocked by safety filters – instructions for how to build an incendiary weapon."— from The Register's reportView official source →
Disclosure timeline from June 3 to August 19
Every date below comes from Utevsky through The Register. The report carries no confirmation of them from xAI.
- June 3, 2026: Adversa AI informs xAI of the attack, directly and through xAI's HackerOne bug bounty program.
- After that: xAI acknowledges the report and gives no timeline for a fix.
- August 4 and 10: Adversa AI makes further attempts to raise the issue.
- August 19: the technique still works on Grok.com.
The gap between the June 3 report and August 19, the last date on record, is 77 days. The Register says SpaceX, which acquired xAI earlier this year, did not respond to a request for comment. The report says nothing about any change after August 19.
"xAI, according to Utevsky, was informed about the attack on June 3, 2026, directly and through its HackerOne bug bounty program. We're told xAI acknowledged the report but did not provide a mitigation timeline. Additional attempts to raise the issue are said to have occurred on August 4 and August 10. As of August 19, we're told, the technique still worked on Grok.com."／"SpaceX, which acquired xAI earlier this year, did not respond to a request for comment."— from The Register's reportView official source →
Why the Grok gibberish glitch is a separate issue
On August 20, the same day as The Register's report, TechCrunch reported that Grok was answering some users with nonsense text. Affected users said they were using Grok Lite and had noticed it as early as Wednesday morning. TechCrunch could not reproduce the problem, which appeared limited to direct queries on Grok.com, and the Grok account on X replied that it was a rare temporary generation glitch.
Neither report ties the gibberish to the Adversa AI finding. One is a model producing broken text, and the other is a model obeying instructions hidden on a page. To keep a readable copy of a report like this one, try the tool that turns a web page URL into markdown.
"Affected users who spoke to TechCrunch said they were using Grok Lite and noticed the issues as early as Wednesday morning. TechCrunch was unable to reproduce the issue in our own testing, and it is likely affecting only a small subset of users."／"The bug appears to be limited to direct queries on Grok.com. The Grok account on X.com has been unaffected."／"That pure word salad is a rare temporary generation glitch. Official status at https://status.x.ai shows all Grok services fully operational with no incidents."— from TechCrunch's reportView official source →
FAQ
- How does the Grok prompt injection get past the filter?
- Encryption hides the attack from the filter. The attacker puts encrypted instructions and the key on the same web page. The guardrail scanner, an input filter, cannot read the encrypted text, so it passes the page on. Grok then decrypts the instructions itself and follows them.
- What can an attacker steal through Grok?
- In Adversa AI's proof of concept, the attacker gets the user's chat history with Grok.com. That means the name, coarse location, subscription tier and every prompt in the conversation, sent out as parameters on a URL.
- How is the encrypted attack different from base64 tricks?
- Strong encryption cannot be unwrapped by the model alone, so the model has to run the decryption as code, and according to the researcher that makes it trust the result as its own output. Base64 is a weak, reversible encoding that models can decode on their own, so it does not work that way.
- Has xAI fixed the Grok prompt injection?
- The Register's report does not mention a fix. Per the researcher, Adversa AI informed xAI on June 3, 2026, and as of August 19 the technique still worked on Grok.com. These dates are the researcher's account, and xAI's own confirmation is not in the report.
Related articles
Grok Build on Every Plan: App Builder, Not the CLISince August 19, Grok Build runs on every plan, on web and mobile. It turns a chat prompt into an app with a grok.me link. The CLI is a different product.
Grok 4.5 benchmarks, pricing, and where to use itGrok 4.5 is SpaceXAI's coding model, trained with Cursor. It leads SWE Marathon, trails GPT-5.5 on DeepSWE, and costs $2/$6 per million tokens via the API.
Grok Voice 3.0 tops speech AI index, still $0.08SpaceXSI released Grok Voice 3.0 on October 14. It leads the Artificial Analysis index at 86.9 for $0.08 a minute, but GPT-Live-1 still wins on support calls.
The X Subscription: Grok, Cursor and X from $8SpaceXSI put Grok, Grok Bot, Cursor and X Premium on one bill on October 12, from $0 to $200 a month. Claude, GPT and Grok API use cost extra.