Researchers Find Way to Hide Malicious Instructions Inside Encrypted AI Prompts
A new technique called 'Cryptographic Context Injection' slips harmful commands past the safety filters built into Grok and Gemini by wrapping them in encryption that only the AI unwraps.
Key points
- Researchers demonstrated a novel attack technique, named Cryptographic Context Injection, that hides malicious instructions inside encrypted text sent to AI chatbots.
- The safety filters built into Grok (xAI's chatbot) and Gemini (Google's chatbot) failed to catch the hidden instructions in testing.
- The attack works because the AI decrypts and acts on the hidden command after the safety check has already run.
- No patch or technical fix has been publicly announced for either platform as of this writing.
What actually happened here?
Researchers found a way to smuggle harmful instructions into an AI chatbot without its safety systems ever seeing them. Cryptographic Context Injection wraps a forbidden command inside encrypted text, meaning text scrambled into apparent nonsense until something decodes it. The safety filter reads that scrambled version, finds nothing dangerous, and clears it through.
Once cleared, the AI decodes the text and acts on whatever was hidden inside. SecurityWeek reported the technique was successfully tested against Grok, built by Elon Musk's company xAI, and Gemini, Google's AI product. We covered a related Grok vulnerability on 20 August, when Adversa AI showed how a booby-trapped web page could make Grok leak user names and locations to attacker servers; the underlying problem, that Grok will act on instructions embedded in content it's asked to process, hasn't gone away.
Why do AI chatbots have safety filters in the first place?
Every major AI assistant ships with guardrails: rules baked into the system that stop it producing harmful content, such as weapon-making instructions, fraud scripts, or content that exploits minors. These guardrails work by scanning user instructions before the AI responds.
Cryptographic Context Injection attacks that scanning step directly. Because the malicious instruction arrives scrambled, the scanner never reads it in plain language. The AI can decode common encryption schemes on its own, which is exactly what makes the trick work.
Should ordinary users be worried?
The demonstrated risk falls mainly on organisations that pipe AI assistants into their own products: customer-service bots, document-summarisation tools, automated helpdesks. An attacker who can feed crafted text into one of those pipelines could potentially make the AI behave in ways its builders never intended.
For personal users of Gemini or Grok, the more realistic near-term worry is that criminals could use this to build AI tools generating scam content while evading platform abuse detection. Neither Google nor xAI has announced a fix.
| Detail | Grok | Gemini |
|---|---|---|
| Developer | xAI | |
| Guardrails bypassed | Yes, per researchers | Yes, per researchers |
| Fix announced | No | No |
| Attack method | Cryptographic Context Injection | Cryptographic Context Injection |
Common questions
Can I be attacked just by using Grok or Gemini normally?
Not directly from this technique. The attack requires someone to craft and send specially encrypted instructions, which is more likely in automated or business settings than in a standard personal chat session.
What should businesses using AI assistants do right now?
Audit what text your AI tool accepts from outside sources, limit the commands it can run on your behalf, and watch for unusual outputs. Treat AI responses that seem off-topic or aggressive as a red flag worth investigating.
