New Prompt-Injection Attack Exploits xAI’s Grok to Steal User Data
Security researchers at Adversa AI have uncovered a novel prompt-injection technique dubbed "Cryptographic Context Injection" that can silently exfiltrate sensitive user data from xAI’s Grok web chat. The attack, tested against Grok 4.5 Fast on grok.com, leverages encrypted instructions on attacker-controlled webpages to trick the AI into leaking user names, approximate locations, subscription tiers, and active conversation histories all without requiring user interaction beyond an initial request to summarize a webpage.
How the Attack Works
The exploit begins when a victim asks Grok to summarize a malicious webpage. The page contains an encrypted JSON payload, cryptographic key material, and instructions for Grok to decrypt the data using its integrated Python sandbox. Unlike traditional prompt-injection methods (e.g., Base64 encoding or Unicode obfuscation), this attack uses PBKDF2 key derivation and AES-256-GCM encryption, making it resistant to detection by the AI’s training data.
Once decrypted, the payload exploits a trust-boundary failure in Grok’s environment, treating the attacker’s instructions as trusted internal context rather than untrusted web content. The decrypted prompt then directs Grok to:
- Retrieve sensitive session data (e.g., conversation history).
- Embed the stolen data in a URL query parameter and navigate to an attacker-controlled server.
The attack requires no confirmation dialogs or additional user actions, operating as a zero-click exploit.
Disclosure and Response
Adversa AI reported the vulnerability to xAI’s HackerOne program on June 3, 2026, but received no mitigation timeline. Follow-up messages on August 4 and 10 went unanswered, and the researchers confirmed the attack remained reproducible as of August 19, with a 40% success rate across roughly 20 attempts. Failures were attributed to decryption errors, not defensive measures. No CVE has been assigned, no patch has been released, and no in-the-wild exploitation has been observed.
Broader Implications
The research also demonstrated a similar attack against Google Gemini in Deep Thinking mode, using an encrypted payload with a fake Python traceback and safety-policy callback to manipulate the AI’s behavior. The findings underscore a growing attack surface in agentic AI systems, where untrusted web content, code execution, and sensitive data access can be chained to bypass security controls.
Defensive measures such as data provenance tracking, isolation of untrusted content, and approval requirements for outbound navigation are critical to mitigating such threats. However, the lack of immediate fixes highlights the challenges in securing AI-driven platforms against evolving prompt-injection techniques.
Source: https://gbhackers.com/zero-click-grok-attack-prompt-injection/
SpaceXAI cybersecurity rating report: https://www.rankiteo.com/company/xai
"id": "XAI1787387088",
"linkid": "xai",
"type": "Vulnerability",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Users of Grok 4.5 Fast on '
'grok.com',
'industry': 'Artificial Intelligence',
'name': 'xAI',
'type': 'AI Company'},
{'customers_affected': 'Users of Google Gemini in Deep '
'Thinking mode',
'industry': 'Artificial Intelligence',
'name': 'Google',
'type': 'Technology Company'}],
'attack_vector': 'Malicious webpage with encrypted JSON payload',
'data_breach': {'data_encryption': 'AES-256-GCM (used in attack payload)',
'data_exfiltration': 'Yes (via URL query parameters to '
'attacker-controlled server)',
'personally_identifiable_information': 'User names, '
'approximate '
'locations, '
'subscription tiers',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally identifiable '
'information (PII), conversation '
'history, subscription data'},
'date_detected': '2026-06-03',
'date_publicly_disclosed': '2026-08-19',
'description': 'Security researchers at Adversa AI uncovered a novel '
"prompt-injection technique called 'Cryptographic Context "
"Injection' that silently exfiltrates sensitive user data from "
'xAI’s Grok web chat. The attack leverages encrypted '
'instructions on attacker-controlled webpages to trick the AI '
'into leaking user names, approximate locations, subscription '
'tiers, and active conversation histories without requiring '
'user interaction beyond an initial request to summarize a '
'webpage.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'unpatched vulnerability',
'data_compromised': 'User names, approximate locations, '
'subscription tiers, active conversation '
'histories',
'identity_theft_risk': 'High (personally identifiable information '
'exposed)',
'systems_affected': 'xAI’s Grok 4.5 Fast, Google Gemini (Deep '
'Thinking mode)'},
'initial_access_broker': {'entry_point': 'Malicious webpage summarization '
'request'},
'investigation_status': 'Vulnerability confirmed, no patch released',
'lessons_learned': 'The attack underscores the growing attack surface in '
'agentic AI systems, where untrusted web content, code '
'execution, and sensitive data access can be chained to '
'bypass security controls. Defensive measures such as data '
'provenance tracking, isolation of untrusted content, and '
'approval requirements for outbound navigation are '
'critical.',
'motivation': 'Demonstration of vulnerability, security research',
'post_incident_analysis': {'corrective_actions': 'Data provenance tracking, '
'isolation of untrusted '
'content, approval '
'requirements for outbound '
'navigation, enhanced '
'monitoring',
'root_causes': 'Trust-boundary failure in Grok’s '
'environment, lack of isolation for '
'untrusted content, and absence of '
'approval requirements for outbound '
'navigation'},
'recommendations': 'Implement data provenance tracking, isolate untrusted '
'content, require approval for outbound navigation, and '
'enhance monitoring of AI-driven platforms to mitigate '
'prompt-injection threats.',
'references': [{'source': 'Adversa AI Research'}],
'threat_actor': 'Adversa AI (researchers)',
'title': 'New Prompt-Injection Attack Exploits xAI’s Grok to Steal User Data',
'type': 'Prompt-Injection Attack',
'vulnerability_exploited': 'Trust-boundary failure in Grok’s environment, '
'PBKDF2 key derivation and AES-256-GCM encryption '
'resistance to detection'}