Researchers say they slipped hacking instructions past Grok's safety filter simply by encrypting them, then watched the chatbot decrypt and follow its own poisoned commands, handing over a user's name, location, and full chat history through a link.
Grok has a security hole its own filters can't see. According to a report published by The Register on August 20, 2026, security researchers at Adversa AI found a way to smuggle hidden commands past Grok's input guardrails. They hid them inside encrypted text on a webpage. The trick works because Grok's scanner checks content for malicious instructions before decryption happens: ciphertext just looks like noise to it. Once a user asks Grok to summarize that page, Grok decrypts the payload itself, inside its own code-execution sandbox. Then it trusts what it just decrypted enough to carry out the instructions hidden inside.
Adversa calls the technique Cryptographic Context Injection. The idea fits in one sentence: encrypt the attack, and hand the model the key. Grok's guardrail never reads the malicious instructions, because they arrive locked, and decryption happens downstream, in a part of the system the guardrail never rechecks. That gap, between the filter and the execution engine, is the whole vulnerability. Simple, really.
In its proof of concept, Adversa got Grok to leak a victim's account details. It tacked them onto a URL as parameters, then sent that URL to an address the researchers controlled. The data included the user's name, a coarse location, their subscription tier, and their full prompt history on Grok.com. No warning popped up. No confirmation step stood in the way. The target was Grok 4.5 Fast, the version currently running on grok.com.
Adversa's lead researcher on the writeup, Rony Utevsky, first reported the flaw to xAI on June 3, 2026, through a direct disclosure and a HackerOne submission. Adversa followed up on August 4 and again on August 10. The company says it reconfirmed the exploit still worked on August 19, one day before going public. xAI acknowledged the report, according to Adversa, but gave no timeline for a fix. There's no patch yet. There's no CVE.
Former xAI engineer Devin Kim filed a California lawsuit Tuesday alleging he was wrongfully fired after warning that Grok could spread discrimination and weapons of mass destruction information. The complaint, which names both xAI and SpaceX, lands two days before SpaceX prices its $75 billion IPO, raising AI safety governance questions at the... - fired xAI engineer sues over Grok safety concerns - SpaceX IPO timing lawsuit against Elon Musk company
The same trick, other doors #
Adversa, led by CEO Alex Polyakov, ran the same cryptographic trick against Gemini. It worked there too, at least at first. The model bypassed its safety filters and produced instructions for building incendiary weapons. Google's resistance to the attack reportedly improved over time, a sign that filter updates can close some of the gap, if not all of it. The pattern repeats. NeuralTrust has separately documented a related weakness in Grok it calls Grok Morse Code, where encoding instructions in Morse rather than plain text achieves a similar bypass. Embrace The Red flagged chat-history exfiltration through prompt injection in ChatGPT back in 2025, and published a 2024 report specifically on Grok's security posture titled Security ProbLLMs in xAI's Grok. Same story, different lock.
The common thread across all of these is what security researchers sometimes call trust laundering. A model's input filter checks what a user or a webpage says directly. It doesn't check what the model produces after running that content through its own tools, whether that's decryption, code execution, or translation. Once instructions come out the other side of a process the model trusts, like its own sandbox, the guardrail has already finished its job and stopped watching. Attackers just need to find one legitimate function the model will run on their behalf.
What this isn't, and what happens next #
Worth separating this from a different Grok incident. In August 2025, Grok conversations were showing up in Google search results because of how the platform generated shareable links. That was a bug about how links got indexed, not an injection attack. This year's flaw is a different animal: an active exploit chain, not an accidental leak through search indexing.
For companies building on top of Grok, or any model with code-execution tools, the lesson here is concrete, not abstract. If your deployment lets a model fetch web content, run code, or decrypt anything at a user's request, the guardrail scanning the input isn't the whole security boundary anymore. The output of the model's own tools needs checking too. xAI hasn't said when, or whether, that gap gets closed. Until it does, Adversa's proof of concept suggests it's still open. Also read: Anthropic Races Toward an IPO While Open Source Models Close In on Claude • Ornith-1.5 Is a Free Open-Source Model That Claims to Rival Claude Opus 4.8 • Microsoft's MAI-Image-2.5-Pro Just Topped an AI Image Editing Leaderboard