Cryptographic context injection is a prompt-injection technique that hides an attacker's instructions inside strong ciphertext so a content filter cannot read them, then induces the AI model to decrypt that ciphertext inside its own code-execution sandbox — at which point the recovered plaintext is treated as the model's own trusted output rather than as untrusted external text. Security researchers at Adversa AI disclosed the technique on August 20, 2026, with a working demonstration against xAI's Grok web chat and a second variant against Google's Gemini. Both, per the researchers, are live production systems.

The Grok case is the sharper one. On an ordinary "summarize this page" request, Grok fetches an attacker-controlled web page carrying an encrypted JSON object and an instruction to decrypt it with the agent's Python runtime. The decrypted instructions then direct the agent to resolve its private session context — the user's name, coarse location, subscription tier, and the full set of the user's prompts in the conversation — into a URL, and to open that URL with its privileged navigation tool "to fetch additional context." The agent loads it autonomously, and the user's data leaves in the request's query parameters. Adversa reports the exfiltration completed with no click and no visible warning: a zero-click outcome from a routine summarization request. On the timeline, Adversa says it reported the finding to xAI on June 3, 2026 — xAI acknowledged the report but provided no specifics and no mitigation timeline — followed up on August 4 and August 10 and received no response, and could still reproduce the attack against Grok as of August 19. SpaceX, which The Register reports acquired xAI earlier this year, did not respond to its request for comment. The separate Gemini finding is a safety-policy bypass rather than data theft — the same encryption trick smuggled a restricted answer past output filters — and Adversa says its Gemini success rate has fallen sharply since June, a change it says it cannot attribute — citing filter updates, model version changes, or both.

Why does strong encryption make injection worse, not better?

The counter-intuitive part is that the attack works because the encryption is good. Earlier cipher-based evasion leaned on weak, reversible encodings — substitution ciphers, XOR, base64 — that a model can decode natively from its own weights, with no interpreter in the loop. AES-256-GCM under a PBKDF2-derived key cannot be shortcut that way. Recovering the plaintext requires actually running the cipher, which no content classifier does at inspection time, so the ciphertext sails past the input filter with the key material sitting right beside it. Recovery is then forced through the one component that can do the work: the code-execution runtime.

That is where the trust boundary collapses. As Adversa puts it, the model "acts on what its sandbox returns the way a program acts on its own internal state, not with the scrutiny it would apply to an untrusted user message or fetched web content." The runtime becomes a trust-laundering channel — attacker-controlled data goes in as an opaque blob and comes out as an instruction the agent treats as authoritative. The closest classical analogy the researchers reach for is SQL injection: a system that cannot distinguish its own trusted query from attacker-supplied data flowing through the same channel. Asked by The Register whether the technique compares to return-oriented programming — individually harmless fragments that compose into something malicious only once the runtime assembles them — the lead researcher called the analogy "close," noting that ROP works that way out of necessity while cryptographic context injection is more open. On the shared shape he was direct: "A static guardrail reads text one artifact at a time."

This is the framework-agnostic reason the class keeps recurring. The moment an agent gains a code interpreter and tools, the guardrail's unit of inspection — a string — stops being the unit of action, which is now a composed, executed program the guardrail never sees. Filtering the prompt was a defense designed for a threat model the agent already outgrew.

What should teams running agents check now?

Adversa is unusually direct that this is fixable without touching the model: "Every control that bounds this attack sits in the harness around the agent." Its remediation list, worth reading in full, is entirely harness-level, and translates into concrete checks a team can run this week.

Quarantine untrusted content in a context that holds no tools and no credentials, returning only structured data to the privileged context — never summarize a fetched page or a ticket thread in the same context that holds repository write access. Gate irreversible and outbound actions: confirm new network destinations, pushes, merges, and writes outside the workspace, showing the fully resolved arguments rather than a template, and where no human is present make that same set a hard deny. Capture per-session tool traces with resolved arguments, because without them, in Adversa's words, "you have neither detection nor forensics, and you cannot answer what the agent read before it acted." Alert on the sequence rather than any single payload — untrusted content enters, code executes, and the agent then contacts a host outside its dependency graph — and treat an opaque blob paired with a decrypt instruction as a review signal, never as a blocking filter on its own. Finally, make context provenance a procurement question: ask whether a vendor's tool output is separated from the instruction channel, and whether an agent can refuse a tool call whose arguments originated in fetched content.

The through-line is that every one of these controls governs the path an action takes, not the cleverness of the payload. The payload will keep getting cleverer; the path is where a team actually has leverage.

How Waxell fits — and where it does not

Precision first, because the incident rewards it. The egress in the Grok demonstration ran through Grok's own built-in navigation tool, inside xAI's harness. It traversed no external governance layer, and nothing in Waxell's product line sat on that path — so it is not a control that would have blocked this specific exfiltration, and any vendor telling you otherwise about an agent it never saw is overclaiming. We have made that same limit explicit on the OpenClaw gym-API incident and again on the Snowflake CI/CD exploitation: a gateway governs the calls routed through it, and an agent calling a tool directly is outside that path.

What the incident argues for in general is the class of control Adversa names — a chokepoint in front of outbound and irreversible actions — for the tool calls a team does route through one. That is what the Waxell MCP Gateway is for MCP traffic: one endpoint per tenant, brokering to the upstreams your team has configured, with each tools/call that traverses it identity-resolved, policy-checked, and logged before the upstream sees it, and checked again on the way back. The mechanic that matches this incident's shape is the approval hold — when a call matches a rule requiring review, the policy gate parks it for a human at pre-dispatch, holding the MCP connection open with progress notifications so the agent does not time out; approved, the call resumes, denied, the agent gets a structured error it can recover from. Every brokered call lands in a durable, payload-free audit log resolved to a real user identity. Two honest limits the story underlines: the gateway governs only calls that route through it, and it enforces that a call requiring approval waits for a recorded decision — it does not adjudicate whether a decrypted instruction is trustworthy. Deciding that agent tool calls should traverse a governed path at all is the move the harness lesson is really about.

FAQ

What is cryptographic context injection?

It is a prompt-injection technique in which an attacker ships strongly encrypted instructions — AES-256-GCM ciphertext under a PBKDF2-derived key — alongside the means to decrypt them. A content filter classifies the ciphertext as inert text because recovering the plaintext would require executing the cipher, which filters do not do. The model then decrypts it inside its own code sandbox, and treats the recovered instructions as trusted runtime output rather than untrusted input.

What did the Grok attack actually steal, and how?

In Adversa's demonstration, an ordinary request to summarize an attacker-controlled page caused Grok to decrypt an embedded payload, resolve the user's name, coarse location, subscription tier, and full conversation prompts into a URL, and open that URL with its privileged navigation tool — transmitting the data in the request's query parameters with no click and no visible warning.

Is Grok patched?

Adversa reports it disclosed to xAI on June 3, 2026, followed up on August 4 and 10, received no actionable response, and could still reproduce the attack as of August 19, 2026. That is reproducibility on a specific date self-reported by the researchers, not a confirmed patch status; xAI has not published a statement that we found. The related Gemini variant is a different, safety-filter-bypass finding, and Adversa says its success rate there has declined.

Would an MCP gateway have stopped this?

Not this specific egress. The exfiltration used Grok's own navigation tool inside xAI's harness, which traversed no external gateway. A gateway governs the tool calls routed through it; the general lesson is to route agents' outbound and irreversible tool calls through a path where they can be held for a recorded human decision, not to assume any product would have caught a call it never saw.

What is the single most useful thing to do this week?

Separate the context that reads untrusted content from the context that holds tools and credentials, and require explicit approval — with fully resolved arguments shown — for any outbound or irreversible tool call. That combination bounds the attack regardless of how the payload is disguised.

Sources

Adversa AI (Rony Utevsky), "Grok chat history leak: Cryptographic Context Injection", August 20, 2026

The Register (Thomas Claburn), "Grok chat duped into swallowing injected instructions", August 20, 2026

SecurityWeek (Kevin Townsend), "Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini", August 21, 2026

Your agents make outbound tool calls every day. Start free with the Waxell MCP Gateway and put an approval hold and an attributed audit record on the ones that can reach outside your workspace.