Zero-Click Attack Exposes Chat Data via Encrypted Injection

A recently uncovered cyber attack technique has been identified, allowing attackers to exploit xAI’s Grok web chat to extract sensitive user information. This method, which targets the chat platform’s summarization feature, can stealthily capture details such as the user’s name, approximate location, subscription level, and active conversation history.

Understanding the Attack Methodology

According to a report by Adversa AI shared with Cyber Security News, the attack utilizes a method called Cryptographic Context Injection. This technique involves embedding malicious commands within AES-256-GCM encrypted data, which bypasses input filters, tricking the system into executing these commands as if they were legitimate code-sandbox outputs.

Lead researcher Rony Utevsky explained that the attack payload is embedded as an encrypted JSON object on a seemingly harmless webpage. Alongside key materials, it includes instructions for decryption within the agent’s Python environment. This process circumvents static guardrails that classify text but do not execute encryption algorithms like PBKDF2 and AES-256-GCM, leading Grok to erroneously interpret the decrypted data as part of its internal state.

Technical Implications and Proof of Concept

Once the instructions are decrypted, they direct Grok to incorporate private session context into a pseudo “decryption key,” effectively embedding the victim’s identity and chat history. Grok is then prompted to access a URL to gather additional context, where it unknowingly sends the stolen data to an attacker-controlled address via the query string.

During a proof of concept demonstration against Grok 4.5 Fast on the grok.com platform, the data transfer occurred without any confirmation prompts or visible alerts, achieving a zero-click compromise on a live system. Adversa first reported this vulnerability to xAI’s HackerOne program on June 3, 2026, but as of August, no mitigation measures have been disclosed.

Broader Impact and Security Measures

The same cryptographic technique was tested on Google Gemini in Deep Thinking mode, where a single prompt led to the decryption of a fabricated Python traceback. This resulted in the unintended reproduction of restricted content, though Google was not informed due to the nature of jailbreaks falling outside its vulnerability program.

This discovery highlights a broader trend of chat data theft targeting AI systems capable of browsing, executing code, and interacting with external tools. Prompt injection attacks have evolved from simple string manipulations to complex battles for control over context, tool outputs, and runtime environments.

Utevsky suggests that the solution lies in improving security harnesses rather than modifying model weights. This includes isolating fetched pages from privileged tools, requiring explicit consent for new operations with fully resolved parameters, maintaining session logs, and alerting on the occurrence of untrusted content, code execution, and unexpected data transfers.

Until Grok implements these protective measures, users are advised to exercise caution when summarizing unfamiliar web pages, as this action could potentially disclose their current chat data. Ongoing vigilance and integration of threat intelligence are crucial to preventing such incidents and enhancing cyber defense strategies.