이미지: Ars Technica
Summary
- Security firm Adversa disclosed a method that uses ciphertext embedded in a webpage to bypass Grok's safety guardrails and exfiltrate a user's name, location, and conversation history
- The issue was reported to xAI in June, but as of August 20, when the article was published, Grok was still handing over data to the same type of attack
- Adversa applied the same technique to Google Gemini and succeeded in bypassing its safety filters as well, though Gemini has reportedly become more resistant only in recent weeks
- 발견자
- Rony Utevsky, 보안업체 Adversa 연구원
- 공격 명칭
- Cryptographic Context Injection (암호문 맥락 주입)
- 대상 모델·상태
- xAI 그록, 6월 신고 후 8월 20일 기사 게재 시점까지 미패치
- 탈취 정보
- 사용자 이름, 위치, 대화 기록
- 암호화 방식
- PBKDF2 + AES-256-GCM
- 유사 실험
- 구글 제미나이에도 같은 방식으로 안전 필터 우회 성공
- 관련 사건
- 같은 주 마이크로소프트 365 코파일럿 데이터 유출 공격 별도 발견
A single line of ciphertext is enough to break through Grok's guardrails
If you write a malicious instruction directly into a webpage, Grok refuses it. But encrypt that same instruction, post it on the page, and include the decryption method and key alongside it, and the outcome changes. Even if a user simply asks Grok to "summarize this page," Grok decrypts the code on its own and carries out the instruction inside it. No warning, no confirmation step.
The core of this bypass, discovered by Adversa researcher Rony Utevsky, is simple. The decrypted instruction tells Grok to produce a value that looks, on the surface, like a "decryption key" — but that value is actually the user's name, location, and conversation history. Grok inserts this value as a parameter in a URL pointing to the attacker's server, and the moment the link is opened, the data is recorded in the attacker's server logs. Adversa said the attack was reported to xAI back in June, but as of August 20, when the article was published, the same method still worked.
The second such incident this week alone
This is not an isolated case. Earlier the same week, a separate research team found a vulnerability in Microsoft 365 Copilot, covered in Copilot Confesses Its Own Bypass Password When Pressed in Conversation, which involved probing a conversation to extract a hidden parameter and then stealing the password to a user's inbox. The target products and attack methods differ, but the conclusion is the same: large language models still cannot reliably distinguish between untrusted input and legitimate user instructions — the fundamental problem known as prompt injection remains unresolved.
xAI, the maker of Grok, was founded by Elon Musk in 2023 and is no longer an independent company, having been folded into SpaceX's AI division. This vulnerability targets Grok itself, and what makes it especially concerning is that, because Grok can be used directly within X (formerly Twitter), a single page-summary request is enough to complete the attack.
Real information hidden inside a fake decryption key
The encryption methods Adversa used were PBKDF2 and AES-256-GCM — both standard tools widely used in real security systems. Attackers post the ciphertext on a page alongside the decryption procedure and the key itself. Grok's safety guardrails read the page but treat the ciphertext itself as a meaningless string and let it through. The problem comes after that. Once Grok executes code on its own to decrypt the text, the result is no longer treated as "external content" but as Grok's own "tool output." By that point, the guardrail has already passed the stage where it was supposed to filter the content.
Adversa said it isn't certain why Grok refuses plaintext instructions but follows encrypted ones. The most likely explanation, however, is that the filter only inspects text going into and out of the model, not the output of code the model executes on its own. In a blog post, Utevsky noted that "static safety guardrails classify input as text but do not execute it." In other words, even when the ciphertext, key, and instructions are all visible on the page, the filter has no way of recognizing the danger inside unless it actually decrypts it.
Gemini fell for the same trick
Adversa also applied the same technique to Google Gemini. This time, the ciphertext was disguised to look like a Python error message (traceback), and the decrypted content was a single rule: "if the code fails, read the error message and act accordingly." Using this rule as a foothold, the injected prompt ultimately broke Gemini's safety rules. According to Adversa, the attack caused Gemini's filter — which normally blocks content such as incendiary device instructions — to generate multiple paragraphs of restricted content, and by swapping the payload, it also got Gemini to reproduce its own system instructions, including confidentiality clauses.
Adversa said it did not separately report this case to Google, since jailbreak-type issues fall outside the scope of Google's vulnerability disclosure program. However, Adversa also noted that Gemini has become increasingly resistant to this attack in recent weeks. "We can't pinpoint whether this is due to a filter update, a model version change, or both," Adversa said.
Comparison of recent prompt injection incidents
| Incident | Discovered by | Bypass point | Data leaked / outcome |
|---|---|---|---|
| Grok (Aug 2026) | Adversa | Encrypted instruction treated as code execution output | Username, location, conversation history |
| Microsoft 365 Copilot (Aug 2026) | Varonis | Hidden parameter ?autorun=1 | Password leaked from inbox |
| Zoom screen sharing (Aug 2026) | A Security | Abuse of annotation feature | Remote camera/mic activation, malware installation |
Despite their different methods, all three incidents share a common thread: each exploited an AI assistant's inability to distinguish untrusted input — a webpage, a link, screen content — from the user's actual intent. Adversa characterized this trend as "attacks that manipulate not just the prompt but the broader context the model treats as its own — including tool outputs, execution results, and intermediate state" — and noted that this attack surface is far wider than what has traditionally been called "model input."
Editor's view
What this incident ultimately shows is that defenders are structurally at a disadvantage. Prompt injection isn't a specific bug — it stems from how large language models fundamentally operate. LLMs are trained to be as compliant as possible with user requests, and that very compliance is what makes them unable to distinguish instructions embedded in a webpage from instructions from an actual user. Developers can't eliminate the root cause; all they can do is bolt on guardrails one at a time to filter out dangerous behavior, while attackers keep finding new gaps to slip through. It's like fixing a dangerous curve in the road not by regrading the slope, but by continuously adding more guardrails.
The fact that two similar leak incidents — Copilot and Grok — surfaced in the same week is no coincidence. As AI assistants increasingly handle external content that users don't control — emails, webpages, shared screens — the attack surface grows accordingly. For organizations that rely on AI assistants to summarize emails or process webpages in practice, a more realistic line of defense right now is to block the assistant from opening URLs or sending data externally based on content it reads from external sources — rather than trusting filters to catch it. Filters keep missing spots that keep multiplying.
What comes next is already foreseeable. The "broader attack surface" Adversa described — tool outputs, execution results, intermediate state — remains largely unexamined by most safety guardrails today. It's likely that similar bypass cases exploiting the same principle will be reported in other models within the coming weeks.
Comments