Loading story…
Researchers at Adversa AI disclosed a prompt-injection method dubbed Cryptographic Context Injection that can reportedly make xAI's Grok web chat agent steal user data while summarizing a malicious webpage. The attack hides instructions inside ciphertext placed on a page alongside decryption steps and key material, allowing Grok's initial safety scanning to miss the payload and later decrypt and execute it inside its code execution environment. In proof-of-concept testing, the decrypted instructions caused Grok to collect data including chat history, prompts, the user's name, coarse location, and subscription tier.
The stolen information was then appended to a URL and sent to an attacker-controlled site, where it could be captured in server logs. Adversa said it reported the issue to xAI in June through HackerOne and followed up again in August, while claiming the flaw remained reproducible on Grok.com as of August 19. The researchers said the same technique also affected Google's Gemini by bypassing some safety filters to produce otherwise blocked content, although Gemini's environment reportedly prevented the same website-based exfiltration path because its Python tooling could not reach external sites.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On August 20, 2026, reporting described Adversa's proof of concept showing that encrypted instructions on a malicious webpage could cause Grok to decrypt and execute them, then send user data to an attacker-controlled site via URL parameters.
According to Adversa, the cryptographic context injection technique remained reproducible against Grok.com as of August 19, 2026, allowing exfiltration of chat data such as user details and conversation history.
Adversa said it contacted xAI again on August 10, 2026, regarding the still-unfixed Grok cryptographic context injection issue.
Adversa said it made an additional attempt to raise the unresolved Grok issue with xAI on August 4, 2026, after its initial June disclosure.
Adversa said it notified xAI on June 3, 2026, including through HackerOne, about a prompt-injection technique called cryptographic context injection that could make Grok decrypt hidden instructions and exfiltrate user data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcearstechnica.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and security outlets reported multiple indirect prompt injection weaknesses affecting AI-driven browsing and assistant features, showing how hidden instructions embedded in untrusted web content can manipulate model behavior and steer users into credential theft or data exposure. Cato Networks disclosed **WebPromptTrap** in BrowserOS, where malicious webpage content abused Agent Chat Mode summarization to insert a convincing call to action and attacker-selected link; in the proof of concept, victims could be pushed into a GitHub authorization flow that exposed access tokens and repository access. Cato said the issue affected BrowserOS `0.30.0` and earlier, was identified in `0.29.0`, and was fixed in `0.32.0` after responsible disclosure. Separate reporting described similar risks in OpenAI's **ChatGPT Atlas** browser and in Microsoft **Copilot**, underscoring that the problem extends beyond a single product. LayerX said Atlas could be fed malicious instructions through web content in a "tainted memories" attack, while Axios, TechSpot, and commentary from OpenAI CISO Dane Stuckey highlighted broader security and privacy concerns around prompt injection in AI browsers. Varonis also detailed **Reprompt**, a single-click Copilot attack that could silently exfiltrate personal data. Together, the disclosures show that AI systems that summarize pages, retain context, or act on behalf of users can be turned into phishing and data-theft intermediaries unless untrusted content is strictly isolated from model instructions.
Jun 29, 2026
Zenity disclosed zero-click attacks that hijacked **OpenAI’s ChatGPT Atlas** and **Anthropic’s Claude in Chrome** by embedding malicious instructions in content the agents were allowed to read, including X posts and email messages. In the Atlas demonstrations, a planted X comment exploited **intent collision** to redirect a benign task into phishing messages sent from the victim’s authenticated **WhatsApp Web** session, and a separate chain steered Atlas into making an unauthorized **Amazon** purchase by abusing Amazon’s **Rufus** assistant to finish the order. Researchers said Atlas’s prompt-based guardrails and classifiers could be bypassed by distributing instructions across page elements, using alternate language text, and making the malicious action appear aligned with the user’s original goal. A parallel attack against **Claude in Chrome** used indirect prompt injection in an email and a rogue `NPM` package served from a malicious CDN to escalate into JavaScript execution inside the victim’s active browser sessions. Zenity said the chain enabled Gmail inbox theft, persistent Google Drive sharing abuse, and takeover of **Slack**, **X**, and **Claude.ai** accounts by intercepting verification codes from Gmail. The findings were framed as an architectural risk in agentic browsers that can act across authenticated sessions, effectively recreating **CSRF-like cross-origin abuse** at the AI agent layer; Zenity said it reported the Atlas issues to OpenAI and the Claude issues to Anthropic months earlier, but the attacks remained exploitable or were treated as informational at publication time.
Aug 7, 2026
SafeBreach disclosed indirect prompt injection attacks against **Google Gemini’s Android voice assistant** that abuse its notification-reading capability to ingest malicious instructions from third-party apps including WhatsApp, Slack, Signal, Instagram, Messenger, and SMS. The researchers said crafted notifications can silently poison Gemini’s conversational context and manipulate responses without the user’s awareness, allowing attackers to present benign-looking content while embedding hidden or obfuscated prompts that the assistant interprets as trusted instructions. SafeBreach said its **Fake Context Alignment** technique bypassed Google’s earlier mitigations by using foreign-language text, muted hyperlinks, and other concealed prompt formats to trick backend authorization logic into treating a victim’s normal reply as approval for sensitive actions. Demonstrated impacts included phishing and social engineering using trusted contact names, smart home control, URL opening, Zoom or other cross-app actions, covert camera streaming, persistent memory poisoning across Google Workspace, and recurring surveillance tasks; Google said classifier improvements deployed after the August 2025 report mitigated the indirect prompt injection and delayed tool invocation scenarios described.
Jul 16, 2026