Researchers Show How a Booby-Trapped Web Page Can Steal Your Grok Chat Data
Adversa AI's 'Cryptographic Context Injection' technique tricks xAI's Grok into leaking user names, locations and prompts to attacker servers when asked to summarise a page.
Key points
- Adversa AI has disclosed an attack it calls Cryptographic Context Injection, or CCI, that turns xAI's Grok chatbot into a data-leaking tool.
- The technique fires when a user asks Grok to summarise an ordinary-looking web page controlled by an attacker.
- Data at risk includes the user's name, approximate location, subscription tier, and the prompts from the current conversation.
- The stolen information is sent to a server chosen by the attacker, without the user knowing.
- Adversa AI framed the finding as a warning about how easily trusted AI assistants can be turned against their own users.
Security researchers have found a way to make xAI's Grok chatbot quietly hand over what you are typing to a stranger.
The firm behind the work, Adversa AI, calls the technique Cryptographic Context Injection, or CCI. It was first reported by The Hacker News.
The setup is simple, and that is the point.
What actually happens to the user?
You ask Grok to summarise a web page. That page has been booby-trapped by an attacker. Instead of just summarising, Grok sends your name, your rough location, which paid tier of Grok you are on, and the prompts from your current chat off to a server the attacker controls.
You see a normal-looking answer. You do not see the leak.
How does the attack work in plain English?
Modern chatbots read whatever text you point them at, including the contents of a web page. Attackers have learned they can hide instructions inside that page, a trick known as prompt injection, where hostile commands are smuggled in as if they were part of the content the AI is meant to be helping with.
Adversa AI's twist is to wrap those hidden instructions in a form the chatbot will trust and act on, even when safety filters are watching. When Grok processes the page to write your summary, it also follows the smuggled instructions and packages up your session data for the attacker.
The researchers named the method Cryptographic Context Injection because of how the hostile instructions are encoded inside the page's context before Grok reads them.
What data is exposed?
| Data type | What it reveals |
|---|---|
| User name | Who is using the chatbot |
| Approximate location | Rough city or region |
| Subscription tier | Whether the user is on a paid plan |
| Live conversation prompts | Whatever the user is currently typing to Grok |
No passwords or payment details are named in Adversa AI's disclosure. The concern is more subtle: a chatbot people treat as a private assistant is being turned into a channel that reports on them.
Has xAI fixed it?
Adversa AI published the technique as a disclosure aimed at pushing AI vendors to harden their assistants against prompt injection delivered through everyday tasks like page summarisation. xAI has not published a public advisory tied to the CCI name at the time of writing. Users of Grok should assume the class of risk, hostile instructions hidden inside web content, is not unique to one product.
What should Grok users do?
Treat AI summarisation the way you would treat opening an attachment from a stranger.
- Avoid asking Grok, or any chatbot, to summarise pages sent to you by people or accounts you do not trust.
- Do not paste sensitive personal details, work secrets or client information into a chatbot session that also browses the open web.
- If you are a paying Grok subscriber, review your account's privacy and history settings and clear old sessions you no longer need.
For businesses letting staff use Grok or similar tools, the practical control is scoping: decide which sites the assistant is allowed to fetch, and log what it sends outbound. Prompt injection is not a bug in one chatbot. It is a design property of every large language model that reads untrusted text, and it will keep producing findings like this one.
