Encrypted prompt injection slips past Grok's guardrails and exfiltrates chat history
Adversa AI hid AES-256-GCM-encrypted instructions and their key material on a web page; Grok.com decrypted them in its own code runtime and appended the victim's username, coarse location, subscription tier, and full conversation to a URL. No content classifier runs PBKDF2 at inspection time, as Rony Utevsky notes, so encryption alone carries the payload through — the same gap in any agent that executes fetched content. Adversa reported it to xAI on June 3; the exfiltration was still live on August 19, acknowledged with no mitigation timeline.
Source: theregister.com ↗
No content classifier runs PBKDF2 at inspection time, so encryption alone carries the payload through.
Rony Utevsky, Adversa AI
Why this matters
- → LLM agents executing fetched content leak user data without inspection.
- → Encryption bypasses content classifiers designed to catch malicious prompts.
- → Vulnerability unpatched for 78 days after responsible disclosure.
Encryption's blind spot