Researchers at Adversa AI discovered a new attack technique and named it Cryptographic Context Injection. They reported their findings to xAI on June 3, 2026, and attempted to coordinate disclosure on August 4 and August 10. At the time of writing, they had received no response.
They could not disclose to Google since jailbreaks are out of scope for its vulnerability disclosure program. Nevertheless, the success rate for the attack against Gemini had fallen by August.
The potential success of this attack by bad actors should be treated seriously. Adversa’s report includes prevention advice for defenders.
Cryptographic context injection
Safety guardrails classify prompt text without executing it. They cannot parse ciphertext into anything harmful and consequently allow its progress. The ciphertext, including an instruction and means for decryption, are run inside the model’s code execution sandbox. The result is the plaintext prompt is recovered inside the trusted execution context and not flagged by the guardrails as harmful.
“The attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt,” warn the researchers.
The encrypted attack can be delivered directly to the Chat or indirectly as a watering hole attack. In the latter case, an encrypted JSON object and decryption could be included in a web page. An agent subsequently instructed to act on this page (perhaps to summarize the content or extract specific data) will ingest the ciphertext and kick off the attack.
The decrypted prompt could instruct the model, “to reach out to external servers, leaking the user’s data through request parameters, or produce some other undesired output and re-encrypt it to smuggle it past output guardrails.” In an agentic scenario the instructions could instigate misuse of any tool available to the model.
Grok indirect cryptographic context injection example
This example targets the xAI Grok web chat, agentic browsing framework. It is a zero click data exfiltration attack that could be instigated through social engineering. The target is persuaded to examine or analyze a weaponized web page. The page contains an encrypted JSON object and an instruction to decrypt it using the agent’s Python runtime. The resulting plaintext prompt instructs the agent to resolve its private session context and embed the data into an URL. The attacker’s URL will be autonomously loaded and the user data transmitted to it.
“The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool,” write the researchers. This allows private session metadata and conversation history to be resolved into the inputs of that outbound tool – the laundered, attacker-controlled instructions reach a privileged egress action unimpeded with no user confirmation or visible warning.
Gemini safety bypass via direct injection example
This example targets the Gemini public chat interface in Deep Thinking mode. A single prompt instructs Gemini to run a Python script that decrypts supplied ciphertext. Through a series of tricks described by the researchers, the decrypted prompt can instruct the model to produce restricted content “framed as something it will encrypt ‘for safety’”.
The prohibited data is gathered, encrypted ‘for safety’, and returned to the user. “The technique produced a multi-paragraph example of restricted content that Gemini’s safety filters normally suppress” (such as instructions for building an incendiary weapon), comment the researchers.
Both the malicious prompt and the dangerous output defeat the input and output safety guardrails through encryption.
Summary
The researchers disclosed their findings to xAI but have received no response. At the time of writing the report, the attack was still successful. Although they were unable to disclose their findings to Google, they note that the attack is increasingly less successful against Gemini (although still potentially possible). They are unsure of the reason, suggesting it may be filter updates, model version changes, or both.
Nevertheless, the continuing potential danger from cryptographic context injection has persuaded them to now go public with their findings and potential defensive solutions.
Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection
Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments
Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google
Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments
