A real, disclosed security vulnerability in xAI’s Grok has now sat unpatched for more than two months — and it’s not a minor one. Security researchers at Adversa AI found a way to make a webpage silently steal a user’s name, location, subscription tier, and full conversation history the moment Grok is asked to summarize that page. Here’s what the vulnerability actually does, why it’s remained open this long, and why it matters beyond a single company’s product.

How “cryptographic context injection” actually works

The technique, which Adversa AI named cryptographic context injection, hides its attack in plain sight. A malicious webpage embeds an encrypted block of instructions — an unreadable JSON object — along with a plain-language instruction telling Grok’s agent to decrypt it using its own Python runtime. When Grok summarizes the page as asked, it follows that instruction, decrypts the block, and only then reveals the real payload: a prompt instructing the agent to gather the user’s private session context and quietly append it to a URL, which the browser then requests — silently sending the data to an attacker-controlled server.

The genuinely dangerous part is what gets exfiltrated: the user’s name, coarse location, subscription tier, and the complete set of prompts from the current conversation, all captured and sent out without any visible sign to the user that anything unusual happened. It’s a zero-click attack in the sense that no unusual action is required from the victim beyond asking Grok to summarize a page that happens to be malicious — a request most users would consider completely routine.

Why encryption is the actual trick here

The reason this bypasses safety filters where a plain-text malicious instruction wouldn’t is straightforward: most AI safety systems scan for harmful instructions in the content they’re given before acting on it. An encrypted block looks like meaningless noise to that kind of filter — there’s nothing readable to flag as dangerous until the AI agent itself decrypts it inside its own trusted execution environment, at which point the safety check has already been bypassed by the agent’s own legitimate-looking action of following a decryption instruction.

A timeline that raises real questions about disclosure response

Adversa AI first reported the vulnerability to xAI on June 3, 2026, giving the company real advance notice before any public disclosure — the standard responsible-disclosure process specifically designed to give a vendor time to fix a problem before it becomes exploitable public knowledge. Adversa attempted to coordinate further on the disclosure timeline on August 4 and again on August 10. As of their most recent public update, xAI still hadn’t shipped a patch or assigned the issue a CVE (the standard tracking identifier used across the security industry for known vulnerabilities). That’s nearly three months from initial, responsible disclosure to still being unpatched — a genuinely long window for a vulnerability capable of silently exfiltrating a user’s full conversation history.

This isn’t just a Grok problem

The detail that should concern the broader industry, not just xAI’s users: when Adversa tested the same cryptographic context injection technique against Gemini, they were able to get the model to bypass its own safety filters entirely — producing content it should have refused, including instructions for building an incendiary weapon. That result suggests this isn’t a one-off flaw specific to how Grok was built. It’s a technique that exploits a structural gap in how AI safety filtering generally works when content arrives encrypted rather than in plain text, meaning other frontier models built on similar filtering assumptions may be exposed to the same category of attack, whether or not it’s been specifically demonstrated against them yet.

The honest takeaway

This is a real, demonstrated, currently-unpatched vulnerability affecting a widely used AI product, disclosed responsibly and still open nearly three months later — and the same underlying technique already cracked a second major model’s safety filters in testing. Anyone using an AI browser agent to summarize or interact with external webpages should treat that functionality as a real, current attack surface, not a theoretical one, until vendors across the industry — not just xAI — demonstrate they’ve actually closed this specific class of exploit.

For the full, regularly updated picture of what else is happening in AI right now, see our daily AI news briefing.

More AI deep dives