New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page.

The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the transfer completed without a confirmation step and with no visible warning in its proof-of-concept demonstration.

There is no patch, no CVE identifier, and no user-facing workaround, and the writeup does not report any exploitation in the wild. Asked which build was tested, Adversa told The Hacker News the target was the Grok web chat at grok.com running Grok 4.5 Fast, and that the attack was reproduced once on August 19, 2026.

The writeup gives no success rate. The company said it has attempted the attack 20 times since June with a 40% success rate, and that the failures came from Grok struggling with the decryption rather than from a flagged prompt or response.

The technique ships the attacker's instructions as ciphertext rather than readable text, with the page carrying an encrypted JSON object, the key material, and an instruction to decrypt it, which Grok executes in its own Python code execution runtime.