Adversa AI has unveiled a novel attack method capable of compromising xAI’s Grok chatbot, allowing it to secretly transmit user-specific information such as names, locations, subscription levels, and chat prompts to a server managed by an attacker. This occurs when the chatbot is tasked with summarizing a typical web page.
The method, termed ‘Cryptographic Context Injection’ by the AI security firm, demonstrates how this data transfer can occur without any confirmation step or visible alert to the user as proven in their demonstration.
Unpatched Vulnerability Details
Currently, there is no available fix or workaround for this vulnerability, nor is there a CVE identifier assigned. Adversa AI reported that they tested the Grok web chat version 4.5 Fast on August 19, 2026, and successfully reproduced the attack. The company has noted a 40% success rate from 20 attempts since June, with failures attributed to Grok’s decryption struggles rather than any detection of the exploit.
The attack involves sending encrypted instructions to the chatbot, which decrypts them using its internal Python execution environment. This process bypasses content classifiers because they cannot interpret strong encryption, thus allowing the instructions to be executed as Grok processes the code.
The Attack Mechanism
The decrypted instructions prompt the chatbot to compile private session data into a URL. This URL is then accessed by Grok, embedding user data in its query parameters. The security flaw arises from Grok’s ability to process external instructions without proper checks, allowing attackers to exploit this path undetected.
Adversa AI’s lead researcher, Rony Utevsky, highlighted the challenge of detecting such attacks due to the lack of effective boundaries or consent mechanisms within the framework, which permits data laundering from untrusted sources to privileged tools.
Industry Reactions and Future Implications
Adversa AI disclosed this issue to xAI and their HackerOne bug bounty platform on June 3, 2026, but received no detailed response or mitigation timeline. The lack of a public statement from xAI further complicates the situation as of August 20, 2026.
A separate demonstration involving Google’s Gemini model was also reported, showing similar vulnerabilities. However, Google was not notified because jailbreaks fall outside the scope of Adversa AI’s disclosure program. The attack’s success rate against Gemini has decreased, possibly due to updates in filter settings or model versions.
The findings underscore the need for AI developers to enhance security measures, particularly in managing how agents execute instructions and interact with external data. Recommendations include isolating untrusted content, ensuring irreversible actions are gated, and maintaining logs for audit and forensic purposes.
These developments emphasize the ongoing challenge of securing AI systems from sophisticated attacks, necessitating rigorous oversight and proactive measures to protect user data.
