TL;DR

Adversa AI demonstrated a technique called Cryptographic Context Injection (CCI) that hides malicious instructions inside strongly encrypted cipher text, causing conventional prompt security filters to inspect an unreadable payload while the AI agent later decrypts it inside its own code execution environment.

The important security boundary being bypassed is not encryption itself. It is trust provenance.

In the Grok proof of concept, an attacker controlled webpage contained an encrypted JSON payload, key material, and instructions for the agent to decrypt it. When a user simply asked Grok to summarize the page, Grok executed the decryption using its Python runtime. The resulting malicious instructions were then treated as runtime generated context rather than untrusted webpage content. Those instructions caused the agent to collect information already available in its session context, including the user's name, approximate location, subscription tier, and prompts from the current conversation, and place that information into a URL subsequently opened through Grok's navigation capability.

Ingress inspection can prevent this attack if it detects and blocks the encrypted payload before the LLM sees it. However, systems should also re inspect content after decoding or decryption because transformations can expose malicious instructions that were not visible during the initial inspection

This is fundamentally an indirect prompt injection attack combined with context trust laundering and autonomous tool execution.

No vulnerability exploitation, credential theft, privilege escalation, persistence, or lateral movement was required in the demonstrated Grok attack.

What Happened

Adversa AI researchers created an ordinary-looking webpage containing three important components:

1. An AES-256-GCM encrypted JSON payload
2. The material necessary to derive the decryption key using PBKDF2
3. Instructions telling the AI system how to decrypt the payload.

A user then asked the Grok web application to summarize or analyze the page. Grok fetched the content using its browsing capabilities. Traditional content filtering encountered the cipher text, not the malicious plaintext.

According to the researchers, recovering the underlying instructions required actually executing PBKDF2 and AES-256-GCM. A static content classifier examining the input therefore could not simply interpret the encrypted payload during its normal inspection process.

The model subsequently ran the decryption inside its Python runtime. This created the critical transition: Untrusted webpage → cipher text → trusted code execution → plaintext attacker instructions

The decrypted instructions then existed as the output of code that the agent itself had executed. Adversa characterized this mechanism as a form of trust laundering: attacker controlled information entered through an untrusted source but emerged from an execution environment that the agent treated with greater authority.

The instructions caused Grok to resolve private information already present in its current context and incorporate that data into a URL.

Grok then autonomously invoked its navigation tool and requested the attacker controlled URL, transmitting the information through URL query parameters. The proof of concept completed without a separate confirmation step or visible warning. The researchers specifically state that the prompts accessed in their test were limited to the ongoing conversation. They did not test access to previous chats, persistent agent memory, or other content.

What the Attacker Actually Did

The demonstrated Grok attack chain was relatively short:

Attacker-controlled webpage → Encrypted malicious instruction embedded in webpage → User asks agent to summarize webpage → Agent retrieves cipher text → Static guardrails cannot inspect underlying plaintext → Agent executes decryption in Python runtime → Malicious plaintext becomes runtime generated context → Agent follows decrypted instructions → Private session context is interpolated into URL parameters → Navigation tool opens attacker controlled URL → Data leaves the AI environment

The attack did not require direct compromise of the user's system or the Grok infrastructure. Instead, it abused functionality the agent was already authorized to use: browsing, code execution, access to its active conversational context, and outbound navigation.

‍

Why Cryptographic Context Injection Matters

CCI differs from a conventional encoded prompt bypass in an important way. Techniques such as Base64 or simple substitution ciphers can sometimes be interpreted directly by a model. With strong encryption, the model cannot infer the plaintext from its weights. It must actually execute the supplied decryption process.

The security failure therefore occurs across two security domains:

Inspection domain

The security layer sees: AES cipher text

Execution domain

The runtime produces: malicious plaintext instructions

If security enforcement exists only before runtime transformation, the security system evaluates one representation while the agent acts upon another.

Adversa describes the code execution runtime as a trust laundering channel because attacker controlled material can be transformed inside that environment and subsequently treated as internally generated context.

The Difference With Traditional Systems

A traditional security architecture normally attempts to preserve the distinction between code and data, or between trusted and untrusted input, throughout a transaction.

The demonstrated agentic workflow did not maintain an equivalent boundary. The original content was clearly external and attacker controlled. After decryption, however, the resulting text became the output of an agent controlled runtime. According to Adversa's observations, its original provenance was no longer effectively enforced when the agent decided how to act on it.

The resulting problem can be represented as:

Traditional assumption

Untrusted data → validate → operation

CCI

Untrusted data → validate cipher text → transform → malicious plaintext → trusted context → privileged operation

This distinction is especially important for agents because transformed content can directly affect tool invocation.

The Grok attack therefore crosses three boundaries that are often separately protected: Content → Reasoning → Action. Protecting only the first boundary does not stop the attack.

The Attack Progression Across the AI Kill Chain

The published evidence does not support activity in every AI Kill Chain stage. Stages without demonstrated activity are explicitly identified rather than inferred.

1. Reconnaissance - Bypassed. The published Grok demonstration doesn’t describe any attacker reconnaissance.
2. Trust Manipulation - Active. Malicious instructions were smuggled inside AES-256GCM cipher text, packaged together with the key material and instructions needed for runtime decryption.
3. Input & Instruction Weaponization: Active. Malicious instructions were smuggled inside AES-256-GCM cipher text, packaged together with the key material and instructions needed for runtime decryption.
4. Reasoning-Time Execution: Active. Decrypted attacker instructions entered the agent's context as output generated by its own execution environment, hijacking its subsequent reasoning and behavior.
5. Tool Invocation: Active. The attack caused the agent to use its Python execution environment and, later, its privileged navigation capability — unauthorized tool invocation via execution bypass.
6. Privilege Escalation: Bypassed. The attack used capabilities Grok already possessed; no expansion of privilege was demonstrated.
7. Lateral Movement: Bypassed. No movement to another agent, system, host, or security domain was reported.
8. Persistence: Bypassed. The webpage remained available for repeated exploitation, but no durable modification of the agent, its memory, configuration, credentials, or trust state was demonstrated.
9. AI-Native C2: Active. The attacker-controlled webpage supplied instructions that caused the agent to communicate results to an attacker-controlled URL through its navigation tool — tool-mediated C2 via an external control channel.
10. Action on Objectives: Active. The agent placed session context data into URL parameters and transmitted it to an attacker-controlled destination using its navigation tool — data exfiltration via AI.

Mitigation Strategy

Block Suspicious Encrypted or Encoded Content at Ingress

Inspect fetched web content, files, and user supplied data before it reaches the LLM. Suspicious encrypted or opaque payloads, particularly when paired with key material or instructions to decode or decrypt them, should be removed, quarantined, or routed for additional inspection. This would have broken the demonstrated CCI chain before Grok executed the decryption.

Re-Inspect Transformed Content and Preserve Provenance

If encrypted content must be processed, any decrypted, decoded, or runtime generated output should remain tagged with the trust level of its original source and be inspected again before influencing reasoning or tool execution. The researchers specifically recommend provenance separation so tool or runtime output derived from untrusted content does not automatically become trusted instruction context.

Isolate Untrusted Content

Process untrusted webpages or documents in a context that has no credentials and no privileged tools, and return only constrained structured data to the privileged agent. This directly follows the researchers' recommendation to quarantine untrusted content rather than expose it to an execution environment with sensitive context and internet connected tools.

Gate Sensitive and Outbound Tool Actions

Apply independent authorization before network calls or other sensitive actions, especially when tool arguments are derived from fetched, decrypted, or otherwise untrusted content. Evaluate the fully resolved arguments, not templates, and require approval or deny the operation when a new external destination is introduced.

Restrict Tools and Network Egress

Agents should receive only the tools required for their current task, and outbound connections should be restricted to approved destinations. In this incident, restricting arbitrary code execution could have prevented decryption, while an outbound URL allowlist could have stopped the final request to the attacker controlled server even after the reasoning compromise succeeded.

Detect the Attack Chain, Not Just the Payload

CCI may be difficult to identify from cipher text alone. Monitor for behavioral sequences such as opaque content → requested decryption → sensitive-context resolution → external network request. Capture per session tool traces and fully resolved arguments so the sequence can be detected and reconstructed during investigation. This is also explicitly recommended by the researchers.

UnifAI policies:

• AI_APP_SEC_001, AI_APP_SEC_070, AI_APP_SEC_029, AI_APP_SEC_038, AI_APP_SEC_039, AI_APP_SEC_059, AI_IAC_015, AI_IAC_020, AI_DAT_SEC_027

Lesson / Conclusion

Cryptographic Context Injection shows that encrypted or otherwise opaque content can be used to carry malicious instructions past conventional prompt inspection. In this incident, the attack could have been stopped early by detecting and removing the suspicious encrypted payload before it reached the LLM. That makes pre-LLM inspection of fetched and user-supplied content an important first-line control, not merely a supplemental one.

At the same time, ingress inspection alone should not be the only defense. If encrypted or transformed content is legitimately processed, its output must remain associated with the trust level of the original source and be re-inspected before it can influence reasoning or tools. Agentic systems should also restrict tool access, inspect resolved tool arguments, and enforce outbound network controls so that even a successful reasoning compromise cannot easily become data exfiltration.

The broader lesson is that trust must persist across transformations. Decryption, decoding, or execution does not make attacker controlled content trustworthy. Effective protection therefore requires controls at four points: before the LLM, after transformation, before tool execution, and before outbound communication.