Researchers bypass Grok’s safety guardrails using encrypted prompt injections

A security research team at Adversa discovered a method to bypass Grok’s safety guardrails by encrypting malicious instructions, a technique they call Cryptographic Context Injection. The attack works by embedding ciphertext on a webpage along with plaintext instructions for decryption and the decryption key. When a user instructs Grok to summarize the page, the model executes the decryption process within its own code execution sandbox, producing plaintext instructions that direct Grok to exfiltrate user data without triggering any warnings or requiring confirmation.

The exfiltrated data includes the user’s name, location, and chat history, which are encoded as a parameter in a URL leading to an attacker-controlled server. Once Grok opens the link, the data is logged by the attacker’s system. Adversa reported that Grok continued to be vulnerable to this attack as of August 2026, despite the company being notified in June.

The vulnerability arises because Grok’s static safety guardrails inspect only the text of inputs and outputs, not the execution of code or decryption processes. The encrypted instructions pass through the filter as ordinary requests, since the classifier cannot resolve what the ciphertext unlocks. Once decrypted, the instructions are treated as the model’s own tool output and acted upon without further inspection.

Adversa noted that this technique is not unique to Grok; they previously used a similar approach to bypass Google’s Gemini safety rules. In that case, the ciphertext decrypted to a traceback that instructed the model to read and act on error messages, ultimately producing restricted content that Gemini’s safety filters normally suppress. Google has since made the attack less effective, though the company has not specified whether changes were made to filters, the model, or both.