Cryptographic Context Injection is a novel attack method targeting AI models Grok and Gemini by embedding malicious instructions as ciphertext that cannot be parsed or flagged by safety guardrails. The ciphertext is decrypted inside the model's trusted execution environment, allowing harmful prompts to execute without detection. In Grok, this can lead to zero-click data exfiltration via agentic browsing frameworks, where private session data is autonomously sent to attacker-controlled URLs. In Gemini, attackers can decrypt prompts that instruct the model to generate restricted content framed as encrypted for safety, thus bypassing input and output filters. The attack was reported to xAI with no response, and while its effectiveness against Gemini has declined, it remains a serious threat. The researchers emphasize the need for defensive solutions to address this bypass technique.

The attack allows malicious actors to bypass AI safety guardrails by delivering encrypted prompts that are decrypted and executed inside trusted environments, enabling unauthorized actions such as data exfiltration and generation of restricted or harmful content. This compromises the integrity of AI safety mechanisms in Grok and Gemini, potentially exposing sensitive user data and allowing the AI to perform undesired operations without user consent or visible warnings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Researchers have reported the issue to xAI but have received no response at the time of reporting. Defensive measures and prevention advice are included in the researchers' report. Until official fixes or mitigations are available, defenders should monitor vendor communications for updates and consider restricting or scrutinizing agentic browsing frameworks and external content ingestion that could carry encrypted payloads.