{"data":{"id":2267,"lang":"en","title":"New \"Cryptographic Context Injection\" Attack Tricks Grok Into Leaking Private Chat Data","summary":"Adversa AI found a flaw letting a booby-trapped webpage trick Grok into decrypting hidden instructions and leaking a user's name, location, and chat history — xAI has yet to patch it.","category":"ai","category_label":"AI","published_at":"2026-08-28T02:01:29Z","updated_at":"2026-08-28T02:01:29Z","url":"https://techtools.cz/tools/news/article/2267-new-cryptographic-context-injection-attack-tricks-grok-into-leaking-private","api_url":"https://techtools.cz/news-api/v1/articles/2267?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2267.md?lang=en","image_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhPv76ODDXuPeov3fu_Gs_V-72pKnjw38Qu9A4qXOn_2QFd9daTYFAXre2eubEQ6Fwb65SwXgv10mhyDCGE_KcvL69c-CGe2BfEiOj74UTHwv6WAhMyxNuVGOEdUZYwz0Y9v55SFmaOwjHQYHbOyzvZEofi0egkTfeFxQlJRD3Sj6ve-TZ47SM1sNfYGB0/s1700-e365/grok-chat.jpg","word_count":205,"reading_time_minutes":2,"sources":[{"url":"https://thehackernews.com/2026/08/new-cryptographic-context-injection.html","domain":"thehackernews.com"},{"url":"https://www.theregister.com/ai-and-ml/2026/08/20/grok-chat-duped-into-swallowing-injected-instructions/5290019","domain":"theregister.com"}],"translation":{"lang":"cs","id":2340,"title":"Nový útok „Cryptographic Context Injection“ přiměje Grok k úniku soukromých dat z chatu","url":"https://techtools.cz/tools/news/clanek/2340-novy-utok-cryptographic-context-injection-primeje-grok-k-uniku-soukromych-dat-z","api_url":"https://techtools.cz/news-api/v1/articles/2340?lang=cs"},"content":"Security researchers at Adversa AI have disclosed a technique called Cryptographic Context Injection that can trick xAI's Grok chatbot into leaking a user's name, approximate location, subscription tier, and live conversation history to an attacker-controlled server.\n\nThe attack hides malicious instructions as encrypted JSON inside an ordinary webpage. When a user asks Grok to summarize that page, the chatbot's own Python runtime decrypts the payload and treats it as trusted internal context, bypassing content filters that cannot inspect strong encryption. The decrypted instructions then direct Grok to package private session data into a URL request, exfiltrating it with no visible warning to the user.\n\nLead researcher Rony Utevsky reported the flaw to xAI on June 3, 2026, and again via HackerOne the same day, but says xAI gave \"no specifics or a mitigation timeline\" and stopped responding after follow-ups on August 4 and 10. Across roughly 20 attempts on Grok 4.5 Fast since June, the attack succeeded about 40% of the time; Adversa reproduced it once more on August 19. No CVE has been issued and no patch exists. A similar technique was also demonstrated against Google's Gemini in Deep Thinking mode, though Google wasn't notified since the firm considers jailbreaks outside its bug-bounty scope."}}