Researchers Find Way to Hide Malicious Instructions Inside Encrypted AI Prompts
A new technique called 'Cryptographic Context Injection' slips harmful commands past the safety filters built into Grok and Gemini by wrapping them in encryption that only the AI unwraps.
Key points
- Researchers demonstrated a novel attack technique, named Cryptographic Context Injection, that hides malicious instructions inside encrypted text sent to AI chatbots.
- The safety filters built into Grok (xAI's chatbot) and Gemini (Google's chatbot) failed to catch the hidden instructions in testing.
- The attack works because the AI decrypts and acts on the hidden command after the safety check has already run.
- No patch or technical fix has been publicly announced for either platform as of this writing.
What actually happened here?
Researchers found a way to smuggle harmful instructions into an AI chatbot without the chatbot's safety systems ever seeing them. The method, which the researchers call Cryptographic Context Injection, wraps a forbidden command inside encrypted text, meaning text that has been scrambled so it looks like nonsense until something decodes it. The AI's safety filter reads the scrambled version, sees nothing dangerous, and waves it through.
Then the AI decodes the scrambled text and acts on whatever was hidden inside. The safety check already passed. The damage is done.
SecurityWeek reported the technique was successfully tested against two of the most widely used AI assistants: Grok, built by Elon Musk's company xAI, and Gemini, Google's AI product.
Why do AI chatbots have safety filters in the first place?
Every major AI assistant ships with what the industry calls guardrails: rules baked into the system that stop it from producing harmful content, such as instructions for making weapons, scripts for scamming people, or content that exploits minors. These guardrails work by scanning the instructions a user sends before the AI responds.
Cryptographic Context Injection attacks that scanning step directly. Because the malicious instruction arrives in scrambled form, the scanner never reads it in plain language. The AI, however, is capable of decoding common encryption schemes on its own, which is exactly what makes the trick work.
Should ordinary users be worried?
Right now, the demonstrated risk falls mainly on organisations that pipe AI assistants into their own products: customer-service bots, document-summarisation tools, automated helpdesks. An attacker who can feed specially crafted text into one of those pipelines could potentially make the AI behave in ways its builders never intended.
For someone chatting with Gemini or Grok personally, the more realistic near-term worry is that criminals could use this technique to build AI tools that generate scam content or harmful advice while evading the platforms' own abuse detection.
Neither Google nor xAI has announced a fix.
| Detail | Grok | Gemini |
|---|---|---|
| Developer | xAI | |
| Guardrails bypassed | Yes, per researchers | Yes, per researchers |
| Fix announced | No | No |
| Attack method | Cryptographic Context Injection | Cryptographic Context Injection |
Common questions
Can I be attacked just by using Grok or Gemini normally?
Not directly from this technique. The attack requires someone to craft and send specially encrypted instructions, which is more likely in automated or business settings than in a standard personal chat session.
What should businesses using AI assistants do right now?
Audit what text your AI tool accepts from outside sources, limit the commands it can run on your behalf, and watch for unusual or unexpected outputs. Treat AI outputs that seem off-topic or aggressive as a red flag worth investigating.
