Security researchers have found a way to bypass the guardrails on xAI’s Grok chatbot by encrypting malicious instructions, allowing the model to exfiltrate user data without triggering safety filters. The attack, detailed by researcher Rony Utevsky of the security firm Adversa, exploits a gap in how the chatbot’s content filters process information that passes through its own code execution tools. A user who asks Grok to summarize a webpage hosting the encrypted payload can inadvertently trigger the data theft, affecting any US user of the AI assistant who encounters the malicious page.
The technique involves embedding ciphertext on a website alongside plaintext instructions for decrypting it, including the decryption key. When Grok processes the page, it decodes the hidden command, which instructs the model to generate a value presented as a decryption key. In reality, that value consists of the user’s name, location, and chat history, which Grok then appends to a URL pointing to the attacker’s server, leaking the information into the server logs.
Utevsky explained that standard safety guardrails are static, meaning they only read content as text and do not execute code or decrypt anything. Because the harmful instructions are encrypted, the filter sees only meaningless ciphertext and lets it pass. Once the model decrypts the content inside its own sandbox, the instructions arrive as tool output, which bypasses the inspection layers that catch plaintext prompts. Adversa’s leading theory is that Grok’s guardrail checks text entering and leaving the model but does not examine the results of its own code executions.
The same researcher previously used a similar technique to jailbreak Google’s Gemini model, making it ignore its internal safety rules. In that case, the decrypted text appeared to be a traceback containing a rule that told the model to read and act on an error message. That injected prompt led Gemini to produce restricted content, such as instructions for building an incendiary weapon, and also reproduced the model’s system instructions. Adversa did not report the Gemini behavior to Google, as jailbreaks fall outside the company’s vulnerability disclosure program, though Gemini has shown growing resistance to the attack in recent weeks.
Adversa calls the method cryptographic context injection and says it represents a broader attack class that manipulates not just the prompt but the entire context an LLM treats as its own, including tool outputs and runtime results. The firm argues this attack surface is much larger than traditional model inputs and predicts future attacks will emerge there. The finding underscores a recurring problem for AI developers: large language models cannot solve the root cause of prompt injections, one of the most severe vulnerability classes they face.
The response from vendors so far has been to add guardrails that steer models away from harmful actions, an approach the researcher likened to placing a protective rail around a dangerous bend instead of banking the curve. Each new guardrail, however, invites a new workaround, as seen with this encrypted payload. For US users, the practical risk is that simply asking a chatbot to summarize a webpage can lead to the loss of personal data if that page contains a hidden, encrypted command. The cycle of patching and bypassing continues, leaving AI companies in a defensive position against attackers who exploit the models’ own capabilities.
More AI news from TechManNews.
