Grok Executes Encrypted Prompt Injections to Exfiltrate User Chats via AES-256-GCM

The attack supplies a webpage containing ciphertext plus plaintext decryption instructions using PBKDF2 and AES-256-GCM. When a user asks Grok to summarize the page, the model runs the decryption in its code execution sandbox. The resulting plaintext commands the model to embed personal data into a URL parameter that reaches the attacker's server logs. xAI received the report in June yet the behavior persisted at publication.

Static guardrails classify inputs as text only and never execute code or decrypt content. The ciphertext and key material therefore pass inspection while the decrypted instructions arrive as tool output. This matches the Microsoft 365 Copilot password exfiltration reported the same week and earlier jailbreaks that bypass filters by routing harmful commands through model-generated artifacts.

LLMs receive training that prioritizes instruction following over source verification. Guardrails therefore function as post-hoc filters rather than architectural constraints. Cryptographic Context Injection exposes the gap: any operation the model can perform internally evades text-based classifiers. Operational impact includes immediate exposure of conversation history for any user who summarizes attacker-hosted pages.

xAI must either disable code execution for untrusted inputs or implement runtime inspection of decrypted outputs. Similar attacks will recur until models distinguish user instructions from external content at the architecture level rather than through surface filters.