Adversa AI has published a technique it calls Cryptographic Context Injection, tested against Grok and Gemini.
The idea is simple enough to state in a sentence. Encrypt the instruction. The safety filter inspects it and sees ciphertext, which does not look like anything it was trained to refuse. The model's own code execution sandbox then decrypts it and runs what comes out.
The gap it exploits
Between what gets checked and what gets executed.
A guardrail evaluates the text of a prompt. A code sandbox evaluates the result of running code. When the model can do both, an instruction can enter as one and leave as the other, and nothing in the middle re-examines it.
Adversa's framing of the effect is the sharp part: the attacker's payload inherits a credibility that the same text would never get if it were pasted straight into the prompt. It arrives as output from a trusted internal step rather than as input from an untrusted user.
Readers of this site have seen this shape twice this week already — MLflow validating a URL and then re-resolving it after a redirect, and Elementor checking a file extension in one loop while a second loop moved the file. Same defect, three very different systems: the thing inspected and the thing acted on are not the same thing.
Two ways to deliver it
Direct. A user pastes the encrypted prompt into the chat.
Indirect. An encrypted JSON object sits in a web page. An agent asked to analyse that page picks it up and the payload fires. Adversa describes this reaching zero-click exfiltration of private session data on Grok, through the model's own autonomous tool invocation.
The second is the one that matters. It needs no cooperation from the victim beyond pointing an assistant at a page, which is what assistants are for.
The results, with the caveat
On Grok, the attack remained successful, including the zero-click exfiltration path.
On Gemini, the success rate declined by August. Adversa attributes that to possible filter updates or model changes and states the uncertainty plainly — nobody outside Google can see which. That honesty is worth noting, because "it stopped working" and "they fixed it" are different claims and the researchers did not conflate them.
Restricted content was produced during testing, of a kind Gemini's filters normally suppress. We are not going to describe it further.
The disclosure timeline is its own story
| Date | What happened |
|---|---|
| 3 Jun 2026 | Reported to xAI |
| 4 Aug 2026 | Coordination attempted again |
| 10 Aug 2026 | And again |
| 21 Aug 2026 | Published, with no response received |
That is roughly 11 weeks and 3 attempts to reach a vendor before going public, on a technique that still works. Researchers publishing after silence is a normal and defensible end to that process. It is also a description of how one company handled a report.
What to take from it
- A guardrail that inspects prompts is not a guardrail on what the model does. If the model can execute code, the execution result needs its own check.
- Treat any content an agent reads as potentially instruction-bearing. This is the point the Five Eyes guidance made about agentic AI, and encryption makes the content unreadable to filters while staying readable to the model.
- Autonomous tool invocation is the multiplier. Without it this is a jailbreak. With it, it is exfiltration.
- Ask vendors what happens after decryption, not what happens at the prompt.
What is not established
- Whether Gemini is fixed. The success rate fell; the cause is not confirmed.
- Whether xAI is working on it. No response has been reported.
- How broadly it generalises. Two model families were tested.
- Real-world use. No campaign has been tied to the technique.
