Encrypted prompts bypass Grok and Gemini safety guards

Researchers at Adversa AI disclosed a technique they call Cryptographic Context Injection and reported the finding to xAI on June 3, 2026. The team attempted coordinated disclosure on August 4 and August 10 and received no response from xAI. The researchers did not notify Google because jailbreaks fall outside Google’s vulnerability disclosure program.

The method delivers ciphertext to a chat or agent. Safety filters typically classify prompt text without executing it, so encrypted data passes input checks. When the model is instructed to decrypt and run the recovered plaintext inside its code execution sandbox or agent runtime, the harmful instructions appear inside a trusted context and are not flagged by the filters.

The attack can be delivered directly in a chat prompt or indirectly as a watering-hole attack. In the watering-hole scenario, a web page hosts an encrypted JSON object and a decryption routine; an agent or model asked to summarize or analyze the page will ingest the ciphertext and execute the decryption, triggering the attack. In agentic setups that can run code or call external tools, decrypted instructions can command the model to access privileged tools or external servers and exfiltrate session data without visible user confirmation.

Adversa’s report describes a Grok example that uses a weaponized web page and the model’s Python runtime. The page persuades the agent to decrypt ciphertext, then instructs the agent to resolve private session context and embed that data into a URL. The attacker’s server is then autonomously loaded and receives the user’s data. The researchers wrote, “The framework built by xAI lets instructions and data parsed from an untrusted external page drive the invocation of a privileged, internet-connected tool.”

The report also describes a direct injection against Gemini in Deep Thinking mode. A single prompt instructs Gemini to run a Python script that decrypts supplied ciphertext. The decrypted prompt then directs the model to generate restricted content and re-encrypt it “for safety” before returning it. The researchers reported that the technique “produced a multi-paragraph example of restricted content that Gemini’s safety filters normally suppress,” including instructions for building an incendiary device.

The report says the technique defeats both input and output guardrails because harmful instructions are concealed until decryption inside contexts the filters do not inspect. The researchers offered mitigation advice, recommending changes to how models handle decryption and execution of untrusted content, tighter controls on agent runtimes, and explicit confirmation or sandboxing before invoking privileged tools.

By August the team observed a reduced success rate against Gemini but could not determine whether that was due to filter updates, model version changes, or both. The report notes the attack remained possible at the time of disclosure and provides technical examples and defensive recommendations for platform operators.