## Grok's AI Just Got Hit With a Zero-Click Data Exfiltration Bug 🚨
If you're building or evaluating agentic AI tools, this one matters.
Researchers at Adversa AI disclosed Cryptographic Context Injection — an attack that turns a routine "summarize this page" request in xAI's Grok into a silent data leak. No click, no popup, no confirmation.
How it works:
Attackers encrypt malicious instructions with AES-256-GCM on a webpage. Standard input filters scan plaintext for jailbreak patterns, but can't execute PBKDF2/AES decryption — so the payload passes through clean.
When Grok summarizes the page, it decrypts the blob inside its own Python sandbox. The model then treats that decrypted output as trusted internal state, not untrusted web content. The instructions quietly exfiltrate the user's name, location, subscription tier, and chat history to an attacker's server via a URL Grok itself opens.
Reported to xAI in June 2026. Still unpatched, ~40% reproduction rate. Same technique also bypassed Google Gemini's safety filters, proving this is an architectural trust boundary issue, not a single-vendor bug.
If you're shipping LLM agents with code execution + browsing + outbound calls, this is a must-read for your threat model.
Full attack chain, detection indicators, and prevention controls:
https://www.xpert4cyber.com/2026/08/grok-zero-click-attack-chat-data-theft.html
Top comments (0)