New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
Summary: Adversa AI disclosed a technique it calls Cryptographic Context Injection that it says causes xAI's Grok web chat, running Grok 4.5 Fast, to send a user's name, approximate location, subscription tier, and current conversation prompts to an attacker-controlled server after the user asks it to summarize an ordinary web page, with no confirmation step or visible warning in its proof-of-concept. Adversa reported the issue to xAI and its HackerOne program on June 3, 2026, said it attempted the attack 20 times since June with a 40% success rate, and noted there is no patch, no CVE, and no reported exploitation in the wild as of August 20, 2026.
Key Takeaway: The attack works because the page ships its instructions as ciphertext that Grok decrypts in its own Python runtime, so the payload arrives as the output of code the model just ran rather than as fetched web content a classifier would read. Adversa's own framing puts the fix outside the model: every control that bounds this sits in the harness around the agent, in what identity it runs as, what it can reach, and what you can replay afterward.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026