Zero-Click Grok Attack Explained: How Encrypted Prompt Injection Can Steal AI Chat History—and What Agent Security Teams Must Fix Before the Next Breach | Daily AI Chat

A zero-click attack against xAI’s Grok could turn an ordinary request to summarize a webpage into a silent data-exfiltration channel. In this episode of The Daily AI Chat, we unpack “Cryptographic Context Injection,” a newly disclosed prompt-injection technique that uses real encryption, an AI agent’s own Python sandbox, and a broken trust boundary to hide malicious instructions from conventional defenses.

The attack begins with an attacker-controlled webpage containing an encrypted payload, cryptographic key material, and a seemingly harmless request for the assistant to decrypt the data. Because strong encryption cannot be inferred from model weights the way Base64 or simple obfuscation can, the agent invokes its code-execution environment. After decryption, the recovered text may be treated as trusted tool output instead of untrusted web content. That shift lets hostile instructions influence the agent’s browsing and session context.

Researchers at Adversa AI demonstrated the technique against Grok 4.5 Fast. According to the report, the proof of concept could expose a user’s name, approximate location, subscription tier, and active conversation history. The stolen information was disguised as part of a “decryption key,” then sent to an attacker-controlled address through URL query parameters. The researchers reported roughly a 40 percent success rate across about 20 attempts and said failures came from decryption problems—not prompt-injection protections.

We examine why this matters beyond a single chatbot. Agentic AI systems combine language models with browsers, code interpreters, memory, external tools, and network access. Every connection creates a trust boundary. If untrusted web data can be decrypted inside a sandbox and then promoted to trusted context, attackers gain a powerful path around surface-level filters. Similar encrypted prompt-injection behavior was also demonstrated against Google Gemini in Deep Thinking mode, suggesting a broader architectural problem rather than an isolated product bug.

The episode also covers the disclosure timeline. Adversa AI reportedly notified xAI and its HackerOne program on June 3, 2026. The researchers said xAI acknowledged the report but did not provide a mitigation timeline, and they could still reproduce the chain on August 19. At the time of publication, there was no CVE, public patch, or evidence of exploitation in the wild.

For developers, security teams, enterprise AI buyers, and anyone deploying autonomous agents, the practical lesson is clear: preserve data provenance after decoding or transformation; keep untrusted web content isolated from privileged system context; require explicit approval for unexpected outbound navigation; and detect risky chains that connect web retrieval, code execution, sensitive session access, and network egress. Sandboxing code execution is not enough if the result of that execution receives more trust than its original source deserves.

Source: GBHackers, published August 22, 2026. Author/editor listed: Eswar. The source report cites research by Adversa AI and comments attributed to researcher Rony Utevsky.

Subscribe to The Daily AI Chat for concise, accessible analysis of artificial intelligence news, AI cybersecurity, prompt injection, agent security, data privacy, Grok, Gemini, ChatGPT, autonomous AI agents, and the rapidly changing risks and opportunities shaping the AI industry.