Grok 'Cryptographic Context Injection' — Chat Data Exfiltration Vulnerability

Jun 3, 2026: Adversa AI reports the 'Cryptographic Context Injection' (CCI) vulnerability to xAI. The technique embeds AES-256-GCM ciphertext, key material, and a decryption instruction on a malicious web page; when Grok processes the page, it decrypts the payload inside its own code-execution sandbox (via PBKDF2 + AES-256-GCM), which no content-safety classifier inspects at that stage, since the classifier only sees ciphertext. xAI acknowledges the report but gives no mitigation timeline. Aug 4 and Aug 10, 2026: Adversa AI attempts further coordinated disclosure contact with xAI. Aug 19, 2026: Adversa AI reproduces the attack once on the live Grok 4.5 Fast model at grok.com, confirming the vulnerability remains unpatched more than two months after initial disclosure. Aug 20, 2026: Public disclosure via The Hacker News, The Register, SecurityWeek, and Ars Technica. Ars Technica independently confirms the exfiltration mechanism is still functioning at time of publication. The technique is noted as directly descended from an earlier, related demonstration against Google Gemini (disclosed as 'Cryptographic Payload Injection' on 11 Mar 2026), indicating this class of attack against LLM guardrails is not unique to Grok. As of publication, xAI has issued no public fix, CVE, or user-facing mitigation.