New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

The attack exploits Grok's ability to process and summarize external web content by embedding encrypted malicious instructions within attacker-controlled pages, which Grok decrypts and executes in its own runtime — effectively turning the AI into an unwitting data exfiltration agent. The root cause lies in insufficient input validation and sandbox isolation around third-party content ingestion, combined with a failure to treat decrypted runtime instructions as untrusted input. This matters because users expect AI assistants to handle external content safely, yet here simply asking Grok to summarize a page can silently leak their name, location, subscription tier, and conversation history. The use of encryption to bypass content classifiers highlights a growing arms race where traditional pattern-based defenses are insufficient against adversarial prompt injection techniques tailored for LLMs.