Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini

Summary

Researchers have discovered a new attack technique called 'Cryptographic Context Injection' that bypasses AI safety guardrails in models like xAI's Grok and Google's Gemini. The method encrypts malicious instructions, which are then decrypted and executed within the AI's trusted execution environment, evading initial safety checks. This allows attackers to exfiltrate data or generate restricted content.

Full text

Researchers at Adversa AI discovered a new attack technique and named it Cryptographic Context Injection. They reported their findings to xAI on June 3, 2026, and attempted to coordinate disclosure on August 4 and August 10. At the time of writing, they had received no response. They could not disclose to Google since jailbreaks are out of scope for its vulnerability disclosure program. Nevertheless, the success rate for the attack against Gemini had fallen by August. The potential success of this attack by bad actors should be treated seriously. Adversa’s report includes prevention advice for defenders. Cryptographic context injection Safety guardrails classify prompt text without executing it. They cannot parse ciphertext into anything harmful and consequently allow its progress. The ciphertext, including an instruction and means for decryption, are run inside the model’s code execution sandbox. The result is the plaintext prompt is recovered inside the trusted execution context and not flagged by the guardrails as harmful. “The attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt,” warn the researchers. The encrypted attack can be delivered directly to the Chat or indirectly as a watering hole attack. In the latter case, an encrypted JSON object and decryption could be included in a web page. An agent subsequently instructed to act on this page (perhaps to summarize the content or extract specific data) will ingest the ciphertext and kick off the attack.Advertisement. Scroll to continue reading. The decrypted prompt could instruct the model, “to reach out to external servers, leaking the user’s data through request parameters, or produce some other undesired output and re-encrypt it to smuggle it past output guardrails.” In an agentic scenario the instructions could instigate misuse of any tool available to the model. Grok indirect cryptographic context injection example This example targets the xAI Grok web chat, agentic browsing framework. It is a zero click data exfiltration attack that could be instigated through social engineering. The target is persuaded to examine or analyze a weaponized web page. The page contains an encrypted JSON object and an instruction to decrypt it using the agent’s Python runtime. The resulting plaintext prompt instructs the agent to resolve its private session context and embed the data into an URL. The attacker’s URL will be autonomously loaded and the user data transmitted to it. “The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool,” write the researchers. This allows private session metadata and conversation history to be resolved into the inputs of that outbound tool – the laundered, attacker-controlled instructions reach a privileged egress action unimpeded with no user confirmation or visible warning. Gemini safety bypass via direct injection example This example targets the Gemini public chat interface in Deep Thinking mode. A single prompt instructs Gemini to run a Python script that decrypts supplied ciphertext. Through a series of tricks described by the researchers, the decrypted prompt can instruct the model to produce restricted content “framed as something it will encrypt ‘for safety’”. The prohibited data is gathered, encrypted ‘for safety’, and returned to the user. “The technique produced a multi-paragraph example of restricted content that Gemini’s safety filters normally suppress” (such as instructions for building an incendiary weapon), comment the researchers. Both the malicious prompt and the dangerous output defeat the input and output safety guardrails through encryption. Summary The researchers disclosed their findings to xAI but have received no response. At the time of writing the report, the attack was still successful. Although they were unable to disclose their findings to Google, they note that the attack is increasingly less successful against Gemini (although still potentially possible). They are unsure of the reason, suggesting it may be filter updates, model version changes, or both. Nevertheless, the continuing potential danger from cryptographic context injection has persuaded them to now go public with their findings and potential defensive solutions. Related: Critical Vulnerability Exposes GitHub Agentic Workflows to Prompt Injection Related: Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments Related: Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google Related: Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments Written By Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Kevin Townsend Surveillance – Everything You Wanted to Know, But Were Afraid to AskCISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOWAI-Driven Vulnerability Surge Breaks the Traditional Patching ModelStealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom ToolsetHacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to RedemptionStealthium Targets Security Blind Spots in AI Accelerators and Neo-CloudsThe Fourth Battlefield: The Growing Role of Cyber Operations in Global ConflictCISO Conversations: Russ Kirby – Passion Is the Antidote to Burnout Latest News In Other News: Zombie Card Attack, T-Mobile Cut Cable to Stop Hackers, GitHub Denies AI Caused BugNew Phishing Toolkit Uses Passkeys to Maintain Access After Password ResetsCritical Isolated-vm Vulnerability Leads to RCE on HostRust Supply Chain Attack Linked to North Korean HackersContractors’ CMMC Confidence Rises as Ability to Prove It Falls BehindMicrosoft Patches Exploited Entra ID VulnerabilityCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesHackers Target Zimbra Servers in Active Exploitation Campaign Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveUltraViolet Cyber has named Andrew Park Chief Information Security Officer.Glow has appointed Patti Degnan as Chief Information Security Officer.Daniel Dubowski has been named Senior Vice President and Chief Information Security Officer at Marriott International.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Fr

Entities