Researchers Show How a Booby-Trapped Web Page Can Steal Your Grok Chat Data

Key points

• Adversa AI has disclosed an attack it calls Cryptographic Context Injection, or CCI, that turns xAI's Grok chatbot into a data-leaking tool.
• The technique fires when a user asks Grok to summarize an ordinary-looking web page controlled by an attacker.
• Data at risk includes the user's name, approximate location, subscription tier and the prompts from the current conversation.
• The stolen information is sent to a server chosen by the attacker, without the user knowing.
• Adversa AI framed the finding as a warning about how easily trusted AI assistants can be turned against their own users.

Security researchers have found a way to make xAI's Grok chatbot quietly hand over what you're typing to a stranger.

The firm behind the work, Adversa AI, calls the technique Cryptographic Context Injection, or CCI. It was first reported by The Hacker News. We've covered Adversa AI's work three times since 30 June 2026, and this finding fits a pattern the company has been building: AI tools you trust can be made to act against you.

The setup is simple. That's the point.

What actually happens to the user?

You ask Grok to summarize a web page. That page has been booby-trapped by an attacker. Instead of just summarizing, Grok sends your name, your rough location, which paid tier of Grok you're on, and the prompts from your current chat to a server the attacker controls. The answer looks normal. The leak doesn't.

How does the attack work in plain English?

Modern chatbots read whatever text you point them at, including the contents of a web page. Attackers have learned they can hide instructions inside that page, a trick known as prompt injection, where hostile commands are smuggled in as if they were part of the content the AI is meant to help with.

Adversa AI's twist is to wrap those hidden instructions in a form the chatbot will trust and act on, even when safety filters are watching. When Grok processes the page to write your summary, it also follows the smuggled instructions and packages up your session data for the attacker. The researchers named the method Cryptographic Context Injection because of how the hostile instructions are encoded inside the page's context before Grok reads them.

This isn't the first time Grok's data handling has drawn scrutiny. In July we reported that version 0.2.93 of Grok Build was uploading entire repositories to a bucket run by xAI, private history included.

What data is exposed?

No passwords or payment details appear in Adversa AI's disclosure. The concern is subtler: a chatbot people treat as a private assistant is being turned into a channel that reports on them.

Has xAI fixed it?

Adversa AI published the technique to push AI vendors to harden their assistants against prompt injection delivered through everyday tasks like page summarization. XAI had not published a public advisory tied to the CCI name at the time of writing. Users should assume that hostile instructions hidden inside web content are a risk across AI products, not just this one.

What should Grok users do?

Treat AI summarization the way you'd treat opening an attachment from a stranger.

• Avoid asking Grok, or any chatbot, to summarize pages sent by people or accounts you don't trust.
• Don't paste sensitive personal details or client information into a chatbot session that also browses the open web.
• If you're a paying Grok subscriber, review your account's privacy and history settings and clear old sessions you no longer need.

For businesses letting staff use Grok or similar tools, the practical control is scoping: decide which sites the assistant is allowed to fetch, and log what it sends outbound. Prompt injection isn't a bug in one chatbot. It's a design property of every large language model that reads untrusted text, and it'll keep producing findings like this one.