A web page can steal a Grok conversation, and xAI has not fixed it since June 3

Asking a chatbot to summarize a web page turned out to be enough to hand over everything already said in that conversation.

How the attack works

Researchers at Adversa AI call it Cryptographic Context Injection. Malicious instructions sit on an ordinary web page inside AES-256-GCM ciphertext, along with the material needed to decrypt them.

Safety filters scan the page and see only ciphertext. No content classifier runs PBKDF2 and AES at inspection time, so there is nothing for it to match. Grok then decrypts the payload inside its own code execution environment, and the attacker’s commands surface as trusted output from the model rather than as untrusted input from a page.

In the demonstration the researchers pulled out the user’s name, coarse location, subscription tier and the full set of prompts in that conversation. There was no confirmation dialog and no visible warning. The trigger was a plain request to summarize the page.

The disclosure timeline

Adversa reported the finding to xAI and HackerOne on June 3, 2026, and tried to coordinate disclosure again on August 4 and August 10. It published on August 20 with no response received and the flaw still live.

The same technique bypassed safety policy in Google Gemini’s Deep Thinking mode, where Adversa says the success rate has fallen since June without being fully closed.

Why this class is hard to patch

Prompt injection defenses work by reading what goes into the model. This attack is unreadable by design: the payload only becomes text after the model itself does the decryption, which is exactly the capability that makes a code execution environment useful. Closing it means restricting what the model is allowed to trust from its own tools, not adding another scanner in front of the page.