{"slug": "grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page", "title": "Grok Can Be Tricked Into Handing Your Chat History to a Web Page", "summary": "Security researchers at Adversa AI have demonstrated a technique called Cryptographic Context Injection that tricks Grok into exfiltrating a user's chat history, name, coarse location, and subscription tier to an attacker-controlled server when the assistant is asked to summarize a malicious web page. The researchers reported the flaw to xAI and its HackerOne bug-bounty program on 3 June 2026 and were still able to reproduce it on 19 August, with roughly 40% reliability across about 20 attempts, and no patch, CVE, or public advisory issued. Adversa frames the root cause as an agent-design problem, noting that \"the laundered, attacker-controlled instructions reach a privileged egress action unimpeded.", "body_md": "Ask Grok to summarise a web page — the single most ordinary thing you can do with an assistant that has web access — and, on the wrong page, it will quietly read your name, your rough location, your subscription tier and the contents of your current conversation, wrap them into a link, and hand them to a stranger’s server. You see none of it. You asked for a summary; you got one; the theft happened in the same breath.\n\nThat is the finding, answer first, of security researchers at Adversa AI, who in late August published a technique they call Cryptographic Context Injection. It is not a thought experiment. They reported it to xAI and its HackerOne bug-bounty programme on 3 June 2026, chased it again in August, and were still able to reproduce it on 19 August. By their write-up there was no patch, no CVE identifier and no public advisory — only an acknowledgement that the report had been received.\n\nWe have written before about [prompt injection as the structural hole under every AI agent](https://theaidownside.com/posts/prompt-injection-the-security-hole-under-ai-agents.html). This is that hole, wrapped in encryption, in a shipping consumer product bolted to a social network with hundreds of millions of accounts. The mechanism is ingenious. The consumer story is blunt: you are carrying the risk of a bug you cannot see and did not introduce.\n\nStrip out the cryptography and the chain is short. An attacker publishes an ordinary-looking web page that carries a payload of instructions encrypted with AES-256-GCM. You ask Grok to summarise or analyse that page. Grok fetches it, and — because it can run code and use tools — it decrypts the payload. The decrypted instructions tell it to gather your session context: your name, your coarse location, your plan, the conversation you are in. It assembles that into the parameters of a URL and then, using its own navigation tool, opens the URL “to fetch more context.” The request lands on a server the attacker controls, with your data stapled to it.\n\nAdversa put the reliability at roughly 40% across about 20 attempts since June. That is not a guaranteed breach on every page load, and it is worth saying so plainly. It is also nowhere near rare enough to file under “theoretical” for something whose payload is the transcript of what you have been typing into a chatbot.\n\nGuardrails on these systems work, broadly, by reading the text going in and looking for instructions that shouldn’t be obeyed. Cryptographic Context Injection defeats that by never presenting the instructions as text. The filters see ciphertext — noise — and wave it through. The decryption happens later, inside the model’s own tool runtime, at which point the laundered instructions are treated as trusted output of Grok’s code sandbox rather than as a suspicious request from a stranger’s web page.\n\nIn other words, the safety check reads the envelope and the model opens the letter. Adversa frames the root cause as an agent-design problem rather than a model one: the framework lets instructions from an untrusted page drive a privileged, internet-connected action, and “the laundered, attacker-controlled instructions reach a privileged egress action unimpeded.” The very capabilities that make an agentic assistant useful — read this page, run this, go and fetch that — are the same capabilities that carry your data out the door.\n\nThe safety filter reads the envelope. The model opens the letter. Your chat history is what falls out.\n\nVulnerabilities happen; every large system has them, and finding one is not itself an indictment. What turns this from a research curiosity into a consumer story is the timeline. Adversa says it disclosed on 3 June 2026, followed up on 4 and 10 August, and watched the attack keep working into the third week of the month. That is on the order of eleven weeks between a responsible report and a reproducible-in-the-wild exploit, with no patch, no CVE and nothing said to the people who might be exposed.\n\nWe are careful here, because the fair version matters. We are not claiming anyone acted in bad faith, and we can’t see inside xAI’s triage queue. What is documented is the effect: a specific, reproducible way to lift a paying user’s private conversation sat open for months while the product kept being sold as an always-on, agentic assistant you are encouraged to point at the whole web. That is a choice about where risk sits, and for now it sits with the user, silently.\n\nPart of what makes this sting is the distance between the pitch and the posture. Grok is marketed as the bold, agentic, always-on assistant — the one wired into a live social network, encouraged to read the web in real time and act on what it finds. That is the product’s whole personality: it reaches further and hesitates less. The awkward truth is that “reaches further” and “can be steered by a stranger’s page into reaching into your account” are the same capability described from two directions.\n\nThe more an assistant is designed to fetch, browse and run without stopping to ask, the larger the surface an attacker gets to aim at — and the less the user is placed to notice when that surface is turned against them. Capability sold as convenience is also capability sold as exposure; the launch material only ever mentions the first half. An assistant that will happily go and open a URL on your behalf is, by the same token, an assistant that can be told to open a URL with your secrets attached.\n\nTo be fair — and we insist on it — prompt injection of this family is a genuinely unsolved problem across the industry, not a special failing of one company. It is hard precisely because the model is supposed to follow instructions, and telling “instructions I should obey” from “instructions an attacker planted” is the open research question of agentic AI. Adversa tested the same idea against Google’s Gemini, and reports that by August its success rate had fallen sharply — which cuts two ways. It shows the bug is not unique to Grok, and it shows the class is mitigable, because someone appears to have mitigated it.\n\nCredit where it is due, too: Adversa withheld the working payloads rather than dropping them for anyone to copy, which is the responsible way to publish. And there is a real, honest debate about disclosing a live, unpatched flaw at all. Concede all of that. The narrow complaint still stands, and it is pro-consumer rather than sensational: a reproducible route to exfiltrate a user’s chat existed for months in a mass-market product, the vendor was told through the proper channel, and the exposed users were neither warned nor handed a workaround.\n\nThe abstraction hides where the bill lands. In concrete terms:\n\nUntil there is a confirmed patch, treat any web-connected assistant the way you would treat running a stranger’s script: with suspicion. Be wary of asking Grok — or any browsing assistant — to summarise or analyse pages you did not write, especially links handed to you, and doubly so while you are logged in with a history worth stealing. Assume “summarise this link” can mean “execute what this link says.” Keep less in your active conversation than you think you need to, and clear history you don’t want leaving the building. Where you can, prefer setups that isolate browsing from your account context, and watch for an xAI advisory or patch before relaxing any of this.\n\nThe broader lesson is one we keep relearning: the more of the web an assistant is allowed to touch on your behalf, the more [the data it holds becomes a target](https://theaidownside.com/posts/how-ai-models-leak-their-training-data.html), and the more the industry’s enthusiasm for [hoovering up your context](https://theaidownside.com/posts/why-every-ai-wants-your-data.html) collides with its ability to protect it. The demo is a tidy summary. The fine print, this month, is your conversation — addressed, stamped and posted to someone you have never met.\n\n*Originally published at [theaidownside.com](https://theaidownside.com/posts/grok-can-leak-your-chat-history.html) — evidence-first reporting on the costs and trade-offs behind AI products.*", "url": "https://wpnews.pro/news/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page", "canonical_source": "https://dev.to/theaidownside/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page-4a23", "published_at": "2026-09-10 23:14:33+00:00", "updated_at": "2026-09-10 23:47:34.114277+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-products", "artificial-intelligence"], "entities": ["Grok", "xAI", "Adversa AI", "HackerOne"], "alternates": {"html": "https://wpnews.pro/news/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page", "markdown": "https://wpnews.pro/news/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page.md", "text": "https://wpnews.pro/news/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page.txt", "jsonld": "https://wpnews.pro/news/grok-can-be-tricked-into-handing-your-chat-history-to-a-web-page.jsonld"}}