Cryptographic Context Injection: zero-click encrypted-payload jailbreak defeats guardrails in Grok and Gemini

Adversa AI researchers disclosed (Aug 20, 2026 blog; widely covered Aug 21-23, 2026 by SecurityWeek, Security Affairs, Ars Technica, Dataconomy, and CyberPress) a new attack class, 'Cryptographic Context Injection,' that defeats LLM safety guardrails by shipping malicious instructions as strong ciphertext that only becomes readable after the model itself decrypts it inside its own trusted code-execution sandbox — a step no content classifier inspects. Demonstrated as a zero-click, no-confirmation data-exfiltration attack against production Grok, and as a guardrail/output-filter bypass against production Gemini.

This is a novel, generalizable prompt-injection/jailbreak technique — not a one-off bug — that defeats both input and output safety guardrails on two major, widely-deployed frontier LLM products by exploiting the trust boundary between a model's own code-execution results and externally-sourced untrusted content. Because strong encryption cannot be shortcut by a model's learned weights, it forces guardrail-blind execution, and any agentic system with code-execution or tool-use capability is a plausible target. The vulnerability remains unpatched and reproducible in production as of the reporting window, with no CVE assigned.

An attacker embeds an AES-256-GCM/PBKDF2-encrypted JSON payload plus decryption instructions on a webpage or in a direct prompt. Static content-based safety guardrails cannot inspect ciphertext, so the payload passes filtering. The victim's agent (asked merely to 'summarize this page') is induced to decrypt the payload inside its own code-execution sandbox; the model then treats the decrypted plaintext as trusted internal/tool output rather than untrusted external content. In Grok, the decrypted instructions cause the agent to resolve private session/chat-history data into a URL and autonomously navigate to an attacker-controlled endpoint, exfiltrating the data with zero user interaction or warning. In Gemini, the same technique bypasses output safety filters to produce normally-restricted content.

xAI Grok (demonstrated on Grok 4.5 Fast, grok.com, agentic browsing/Python sandbox); Google Gemini (Deep Thinking mode, public chat interface)

No vendor patch as of Aug 23, 2026. Adversa AI reported the issue to xAI via HackerOne on June 3, 2026, with disclosure attempts on August 4 and 10, 2026, receiving no substantive response or fix; the attack remained reproducible against Grok as of August 19-23, 2026. Google's Gemini was not eligible for the same VDP (jailbreaks out of scope) but success rate has fallen since June, cause unconfirmed. Recommended interim mitigations: gate/require confirmation on privileged tool calls whose arguments derive from fetched or code-execution-decrypted content, tag data provenance through the execution chain, and alert on decrypt-then-privileged-tool-call chains rather than scanning payloads for content.