InfoSecBulletin Cybersecurity for mankind
A new hacking technique has been demonstrated to steal data from Elon Musk’s Grok AI. It uses a simple trick to make the AI take user chats and personal info. This comes after a similar attack on Microsoft 365 Copilot earlier this week, where a hidden input made the AI give away a password. Even though they were told about the Grok issue in June, the assistant was still leaking data when this was reported, according to a recent Ars Technica article.
Cryptographic context injection
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Safety guardrails classify prompt text without executing it. They cannot parse ciphertext into anything harmful and consequently allow its progress. The ciphertext, including an instruction and means for decryption, are run inside the model’s code execution sandbox. The result is the plaintext prompt is recovered inside the trusted execution context and not flagged by the guardrails as harmful.
“The attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt,” warn the researchers.
The encrypted attack can go straight to the Chat or happen indirectly through a watering hole attack. In the second case, a coded JSON object and the key to unlock it could be part of a web page. An agent told to work on this page (maybe to summarize it or pull out certain data) will take in the ciphertext and start the attack.
The decrypted prompt could instruct the model, “to reach out to external servers, leaking the user’s data through request parameters, or produce some other undesired output and re-encrypt it to smuggle it past output guardrails.” In an agentic scenario the instructions could instigate misuse of any tool available to the model.
Grok indirect cryptographic context injection example
This example is about the xAI Grok web chat and how it can be attacked. It’s a type of attack where data is taken without clicking. It can happen through tricks or manipulation. The target is convinced to look at a dangerous web page. This page holds a coded message and tells the user to unlock it using the agent’s Python tools. Once unlocked, the message tells the agent to fix its session and put the data into a web link. The attacker’s link will open by itself, and personal user data will be sent to it.
“The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool,” write the researchers. This allows private session metadata and conversation history to be resolved into the inputs of that outbound tool – the laundered, attacker-controlled instructions reach a privileged egress action unimpeded with no user confirmation or visible warning.
Gemini safety bypass via direct injection example
This example focuses on the Gemini public chat in Deep Thinking mode. One prompt tells Gemini to run a Python script that decodes the given ciphertext. Through a series of tricks described by the researchers, the decrypted prompt can instruct the model to produce restricted content “framed as something it will encrypt ‘for safety’”.
The prohibited data is gathered, encrypted ‘for safety’, and returned to the user. “The technique produced a multi-paragraph example of restricted content that Gemini’s safety filters normally suppress” (such as instructions for building an incendiary weapon), comment the researchers.
Both the harmful prompt and the risky output bypass the input and output safety rules using encryption.
Adversa told xAI about the Grok flaw on June 3, 2026, but didn’t get any reply after the first acknowledgement. The attack still worked just before the report came out. The Gemini issue wasn’t officially reported because Google’s bug bounty doesn’t cover jailbreaks. Adversa mentioned that Gemini’s vulnerability rate has dropped a lot since June.
Related News:
“sockpuppeting” can jailbreak 11 AI models like ChatGPT, Claude, and Gemini
Researchers found security flaws in every script generated by ChatGPT, Copilot, and Gemini
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
