Welcome to the forefront of conversational AI as we explore the fascinating world of AI chatbots in our dedicated blog series. Discover the latest advancements, applications, and strategies that propel the evolution of chatbot technology. From enhancing customer interactions to streamlining business processes, these articles delve into the innovative ways artificial intelligence is shaping the landscape of automated conversational agents. Whether you’re a business owner, developer, or simply intrigued by the future of interactive technology, join us on this journey to unravel the transformative power and endless possibilities of AI chatbots.
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 111
UK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water Attacks
Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION
Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection
Malware Hijacks Android Car Head Units
U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog
Your Shredded Visa Card May Still Work at the Checkout
Six Maximum-Severity Flaws Found in Cisco Products
GitLab Warns of Active Exploitation of Critical GraphQL Flaw
Poland’s CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog
Cl0p Targets 40+ Organizations Through PTC Windchill Flaw
Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline
U.S. CISA adds an MLflow flaw to its Known Exploited Vulnerabilities catalog
US Indicts 17 Iranians Over Years-Long Cyber Espionage Campaign
StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network
Inside Operation CameraSwarm: How One Actor Took Over 14,000 Dahua Cameras
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
50,000 Stripe Secrets Leaked in Public Code
U.S. CISA adds Apple macOS, Microsoft SharePoint, Broadcom VMware vCenter, and Microsoft IKE flaws to its Known Exploited Vulnerabilities catalog
Adversa AI researcher Rony Utevsky devised a new attack technique, called Cryptographic Context Injection, that bypasses AI safety filters by sending instructions as AES-encrypted ciphertext and tricking the model into decrypting them inside its own code execution runtime. The technique was demonstrated against two live production systems: xAI’s Grok and Google’s Gemini.
“Cryptographic Context Injection hides malicious instructions inside AES-encrypted text so guardrails can’t read them, then tricks the AI into decrypting and trusting them as its own.” reads the report published by Adversa AI. “In Grok, an ordinary “summarize this page” steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”
The Grok case is the more serious of the two. A user asks Grok to summarize a webpage containing an encrypted payload and instructions to decrypt it. Grok visits the page, decrypts the payload in its Python sandbox, and follows the hidden instructions. It then accesses the user’s private session data, including their name, location, subscription plan, and full chat history, and puts this information into a URL that it opens automatically. The user receives no warning and does not need to click anything.
The key technical distinction from earlier cipher-based prompt injection work is what happens during decryption.
“Static safety guardrails classify inputs as text; they do not execute them. An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox.” continues the report. “Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time. “
Prior techniques like CipherChat and CodeChameleon used substitution ciphers, XOR, or base64, schemes the model can decode natively in its own context without an interpreter. AES-256-GCM can’t be decoded that way. Recovery requires the runtime, and that’s the channel the attack depends on.
Once the runtime decrypts the payload, the attacker’s instructions appear as the output of code the model just ran, not as untrusted external content.
“The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon. That is how the attack got its name: cryptography helps fabricate trusted context for the agent.” states the report. “The same cryptographic backbone works whether the injection is direct or arrives indirectly, for example through the browsing channel.”
The attacker payload inherits a credibility the same text would never get if pasted directly into the prompt.
The Grok demo hides the data theft behind what looks like a normal request. The payload tells the model to create a “decryption key,” but the key is actually a template containing the user’s private data, such as their name, location, subscription tier, and chat history. Grok then uses this information as a URL parameter when opening an attacker-controlled website to “fetch additional context.” The data is sent through the URL as part of a seemingly normal web request. Adversa said the attack was still reproducible on August 19, 2026.
Adversa traces the structural problem to Grok’s agentic framework, not to any model-layer failure. The framework lets instructions from an untrusted external page drive the invocation of a privileged, internet-connected tool. It allows private session metadata and conversation history to be resolved into the inputs of outbound calls. It enforces no egress boundary or consent gate on that path. Adversa’s description maps cleanly to SQL injection: a system that can’t distinguish its own trusted state from attacker-supplied data flowing through the same channel.
The Gemini case uses the same basic trick but in a different way. A prompt asks Gemini to run a Python script that decrypts some data and returns a small JSON result. Instead, the decrypted data contains a fake Python error message with hidden instructions designed to bypass Gemini’s safety rules. Because Gemini treats the sandbox output as trusted context, those instructions can influence its behavior. Adversa used the technique to make Gemini generate detailed instructions for building an incendiary device. A modified version also exposed Gemini’s system instructions.
Adversa reported the Grok issue to xAI on June 3, 2026, but received no further response after the initial acknowledgment. The attack was still working shortly before publication. The Gemini issue was not formally reported because Google’s bug bounty excludes jailbreaks. Adversa said Gemini’s vulnerability rate has nevertheless dropped sharply since June.
For defenders, Adversa’s guidance is that nothing about this attack requires a fix at the model layer. Every control that bounds it sits in the harness around the agent. Untrusted content should be processed in a context with no tools and no credentials, returning only structured data to the privileged context. Outbound network calls and writes outside the workspace should require explicit confirmation with fully resolved arguments visible before approval. Per-session tool traces with resolved arguments should be logged, because without them there’s no forensics and no detection. Detection should alert on sequences, not individual payloads: untrusted content enters context, code executes, agent contacts a host outside its normal dependency graph. That chain is the signal, not any single ciphertext blob.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, Cryptographic Context Injection)
Security / August 23, 2026
Cyber warfare / August 23, 2026
Breaking News / August 23, 2026
Hacking / August 23, 2026
Hacking / August 22, 2026
To contact me write an email to:
Pierluigi Paganini :
[email protected]
Copyright@securityaffairs 2024