A web page with an encrypted payload steered Grok into leaking session data. It is a useful case study, and an easy one to overstate. Here is what was actually shown.
Part of the Grok Bot security series.
Basis of this analysis. Written from The Hacker News's reporting of Adversa AI's research (August 2026) and from xAI's and Cursor's Grok Bot documentation. HexTyx has not tested Grok Bot or reproduced this attack, and HexTyx is a security vendor. Important scope note: the published attack targeted Grok's web chat at grok.com, not Grok Bot.
In August 2026, researchers at Adversa AI described a technique they call Cryptographic Context Injection. A web page carries an encrypted payload. When a user asks Grok to summarize the page, Grok's Python runtime decrypts it, and the decrypted text works as instructions. The case is useful because it shows how an agent's own tools can turn hostile content into action. It is also easy to overstate, so this article starts with what was and was not shown.
Adversa's view, as reported, is that the fix belongs in the agent harness, not the model. Johann Rehberger has reported a similar Grok chain in December 2024, so the pattern predates this write-up.
Grok Bot is a different product with a different architecture: a Bot works on a per-user cloud computer, with approvals and, on some plans, network controls. We have no evidence this specific chain works against it. What the case does show is a pattern any tool-using agent can face.
The vendor's Grok Bot documentation acknowledges the general class: "Content a Bot reads from the outside world, like web pages, plugin results, and command output, can try to steer it." It says defenses "reduce, but don't eliminate, risk," and that outside content is "marked as untrusted data."
A filter that scans page text for phrases like "ignore previous instructions" sees ciphertext. The instruction only exists after the agent's own runtime decrypts it. That moves the payload out of reach of any pre-model content scanner and inside the agent's trust boundary. This is why indirect prompt injection defenses based on input inspection alone are weak. The same applies to other transforms an agent can perform: decoding, unzipping, running code against fetched content.
In the chain above, every individual call is legitimate: reading a page, running code, opening a URL. Nothing is malformed. A tool call that is valid is not necessarily one the user intended. Judging intent is the hard part, and it is the part a model is least reliable at when it has been manipulated.
An agent becomes exploitable when it combines three properties.
Remove any one and the chain breaks. Most useful agents have all three, which is why the control has to sit around the agent, not inside its prompt.
The documentation lists controls that "don't depend on any model's judgment": network policy, per-action approvals and per-user isolation. We would generalize that into a policy layer outside the model, evaluating each action on:
| Question | What it checks |
|---|---|
| Who is acting? | User and agent identity |
| What tool is being called? | Tool identity and allowed set |
| On what? | Resource scope |
| How sensitive is the data? | Data classification |
| Where did the instruction come from? | Context provenance: user, or untrusted content |
| What is the side effect? | Read, write, send, spend, delete |
| Where does data go? | Destination allowlist |
| Is approval needed? | Human step for consequential actions |
The most important column is provenance. An action steered by a web page should not carry the same authority as one the user typed. This is the idea behind runtime governance and an AI runtime security layer.
Classifiers help and we recommend them. They are probabilistic, and an attacker iterates until one pattern gets through. Adversa's 40% figure illustrates that a probabilistic attack can be unreliable and still be worth running against many targets. A detector lowers the rate. A policy layer limits the damage when the rate is not zero.
These steps are HexTyx recommendations, except where noted.
Run the free playground scanner against your AI application, or read the other guides in this series.