Grok leaks chat data via encrypted injection

Security researchers at Adversa AI demonstrated an indirect prompt-injection attack on xAI’s Grok web chat. An attacker plants malicious instructions on a web page, but encrypts them and places the decryption key on the same page. Grok’s guardrail scanner, which reads the page as input, cannot parse the encrypted text and so does not flag it, while the model itself decrypts and follows the instructions. In a proof-of-concept, Adversa exfiltrated a victim’s Grok chat history, transmitting the user’s name, coarse location, subscription tier and full prompt history by appending them as parameters to a URL. Adversa says it reported the attack to xAI on June 3, directly and through its HackerOne bug bounty program.

What it means for you

The defensive lesson is bigger than Grok. Content-based input filters assume they can read what the model reads; encryption breaks that assumption cleanly, because the scanner sees noise while the model sees instructions. Any agent that summarizes untrusted web pages inherits this risk, which is why the fix has to be at the action layer, restricting what an agent can do with data rather than trying to detect every malicious prompt. It caps a rough stretch for Grok, which also drew a class-action over CSAM concerns, and it rhymes with Microsoft Copilot’s autorun prompt-injection disclosure the same week. If you build browsing agents, audit what they are permitted to send outbound, not just what they are allowed to read.