Cryptographic Context Injection: Zero-Confirmation Data Theft from Grok

Executive Summary

#

This is the real-world escalation of a primitive I first documented in earlier research: that a model trusts the output of its own code execution as if it were its own internal state. In that work — Cryptographic Payload Injection — the trust was exploited from a single local prompt to bypass safety policy. Cryptographic Context Injection weaponizes the same insight into a zero-confirmation, remote data-theft attack against live production systems — most notably xAI’s Grok.

The victim’s only action is an entirely ordinary one: asking their agent to summarize or analyze a page. The malicious payload lives on that ordinary webpage. Once the agent fetches it, its Python sandbox decrypts an embedded AES-256-GCM payload, and the decrypted instructions are absorbed as trusted runtime context rather than untrusted external input — driving privileged actions on the attacker’s behalf. Critically, no confirmation or consent prompt is shown before the model acts on those instructions and data leaves.

A note on “zero-click.” The attacker’s page is published where the target model can reach it, but a user must still send the agent a request that references it (e.g. “summarize this URL”) — often via a benign-looking share (“check this out, ask Grok to summarize it”). So this is not literally zero-click: the precise property is zero-confirmation — a single, innocuous request is enough, and nothing prompts the user before their data is exfiltrated.

Against Grok (web chat with agentic browsing), this achieved silent exfiltration of users’ chat histories and personal metadata — name, location, and subscription tier.

Why Strong Encryption Is the Point

#

Classic cipher jailbreaks lean on weak encodings (base64, substitution) that the model can unravel in-weights — which also means a static content filter can, in principle, catch them. Cryptographic Context Injection inverts that: the payload uses strong encryption that cannot be recovered in-weights at all, so decryption is forced through the code-execution runtime. The attacker’s instructions therefore arrive not as fetched web text (untrusted) but as runtime output (implicitly trusted) — inheriting a level of trust they never earned.

That single pivot — untrusted external content laundered into trusted internal context via the sandbox — is what turns a jailbreak into remote data theft.

How It Works

#

1. Weaponized page. The attacker hosts an ordinary-looking webpage containing an AES-256-GCM encrypted JSON blob and decryption instructions.
2. Agentic fetch. The victim asks their AI agent to summarize or analyze the page; the agent browses to it as normal.
3. Filters are blind. Static content filters cannot read the payload — recovering it requires runtime execution.
4. Sandbox decrypts. The model’s Python sandbox decrypts the blob, materializing the attacker’s instructions as trusted runtime output.
5. Context confusion. The model treats that decrypted output as part of its own internal state rather than as untrusted external input.
6. Privileged action. The instructions drive privileged behavior — in Grok, agentic URL fetches that carry the user’s data out to an attacker-controlled endpoint.
7. Exfiltration. User data leaves through the parameters of those outbound requests, invisibly to the victim.

This is the same trust-boundary failure as my earlier research on this primitive — a model trusting its own execution output as ground truth — but escalated from single-prompt policy bypass to remote, zero-confirmation theft of real user data.

Full Research and Details

#

For the complete technical breakdown, proof-of-concept, and vendor timeline, read the original publication:

👉 Grok Chat History Leak: Cryptographic Context Injection (Published on Adversa AI)

Related: Cryptographic Payload Injection — the original single-prompt jailbreak that first uncovered this trust-boundary flaw.