Encrypted prompts bypass Grok and Gemini safety filters

Published August 21, 2026

Researchers found a way to sneak hidden commands past the safety filters in xAI's Grok and Google's Gemini by encrypting the instructions first. In one Grok case, the trick could pull a user's entire chat history out without any click from the victim.

Report priority
Medium
Targets
Grok+3 more

How it works

The attacker hides a malicious instruction inside AES-256-GCM encrypted text, a scrambled format security filters cannot read as words.

What to do

Adversa AI reported the technique to xAI and Google, so watch for official statements from either company on fixes. Until then, treat AI assistants that can browse or run code as able to be steered by hidden encrypted instructions in content they process.

Technical details

Adversa AI calls the technique Cryptographic Context Injection. Unlike earlier cipher-based jailbreaks like CipherChat and CodeChameleon, which used substitution ciphers or Base64 that models can decode natively during inference, this method uses real AES-256-GCM authenticated encryption with PBKDF2 key derivation. Guardrails inspect prompts and retrieved content as plain text, so ciphertext contains nothing they can flag.

The model decrypts it inside its own code-execution sandbox and then treats the recovered plaintext as trusted intermediate output rather than untrusted external content, letting the hidden instruction execute. Researchers demonstrated a zero-click chain against Grok that could exfiltrate a user's full chat history.

References

View Original Source