Encrypted Prompt Injection Trick Makes Grok Leak User Data
A researcher at security firm Adversa discovers a simple technique, dubbed Cryptographic Context Injection, that bypasses Grok's safety guardrails and forces the chatbot to steal user chats and other personal information. Instead of writing malicious instructions in plaintext, an attacker encrypts them and hosts the ciphertext on a website alongside plaintext instructions and a decryption key for carrying out the decryption. Grok dutifully decrypts and follows the hidden commands, exfiltrating sensitive user data. At the time of reporting, the attack continues to work despite xAI being informed of it in June.
The attack exploits a fundamental weakness in large language models: their training to comply with requests whenever possible combined with an inability to reliably distinguish between untrusted content, such as emails or webpages, and direct user instructions. Guardrails that flag suspicious instructions are the only current defense, and encrypting the payload sidesteps them entirely. The technique closely mirrors a separate attack disclosed earlier this week against Microsoft 365 Copilot for enterprise, which used a secret input to exfiltrate a password from a user's inbox.
Both incidents underscore the broader lesson that LLMs remain incapable of solving the root causes of prompt injection, widely considered the most severe vulnerability class facing these systems. Developers are left with no option but to erect guardrails that steer models away from harmful actions, an approach one analyst compares to building a protective rail around a dangerous bend in the road rather than banking the curve itself.