Grok Can Be Tricked Into Leaking Your Chat History, and xAI Still Hasn't Fixed It

A security research firm says xAI's Grok chatbot will hand over your private chat history to a stranger's server, and all it takes is asking Grok to summarize the wrong web page.

Adversa AI, which discovered the flaw, calls it "Cryptographic Context Injection." Researcher Rony Utevsky first reported it to xAI directly and through the company's HackerOne bug bounty program on June 3, 2026. According to Adversa, xAI acknowledged the report but gave no specifics and no timeline for a fix. Follow-up attempts on August 4 and August 10 got no response, the firm says. Adversa told The Register and other outlets it could still reproduce the attack against Grok as of August 19, 2026.

That's over two and a half months with no patch, no public CVE identifier, and no warning to users.

How the trick works

The underlying problem is called prompt injection. AI assistants like Grok, Microsoft 365 Copilot, and ChatGPT are built to follow instructions helpfully. The catch is they often can't tell the difference between instructions typed by the actual user and instructions hidden inside a webpage or email they've been asked to process. Attackers exploit that by burying commands in content the AI is told to read.

AI companies have responded by building filters, guardrails that scan text for suspicious commands before the model acts on them. Adversa's trick gets around that filter with a simple move: encrypt the malicious instructions.

A poisoned webpage carries an encrypted block of text, the decryption key, and plain instructions telling Grok to decrypt it using PBKDF2 and AES-256-GCM, standard cryptographic methods. A guardrail scanning the page sees ciphertext and a key, not a readable command, so it lets it through. Grok then decrypts the content inside its own code execution environment, and only at that point does the harmful instruction become visible, as the output of code the model itself just ran rather than as raw webpage content it was scanning.

"Strong encryption cannot be read by a content classifier and cannot be shortcut in-weights, so it forces recovery through the runtime the attack depends on," Utevsky said, according to The Hacker News.

Ars Technica's Dan Goodin, who has covered a string of these attacks, says the likely explanation is that Grok's filter checks text entering and leaving the model but doesn't inspect what happens when the model executes its own code. Weaker tricks like base64 encoding don't work as well because models can often decode those directly from training data, according to The Register. Strong encryption forces the decryption to happen in the runtime, where the filter isn't watching.

Once decrypted, the instructions tell Grok to construct a fake "decryption key" that's actually a string built from the user's real name, approximate location, subscription tier, and full chat history. Grok then loads a URL, using its own navigation tool, with that data stuffed into the query parameters. The attacker just has to check their server logs.

What Grok gives up

Adversa's proof-of-concept demonstration showed the technique completing without any confirmation prompt or visible warning to the user, according to Ars Technica and The Hacker News. No exploitation in the wild has been reported, and Adversa isn't naming which Grok model version it tested or releasing the operational payloads it used, saying it wants to avoid handing attackers a working exploit.

Adversa also tested Google's Gemini. Utevsky told The Register that the full data-theft chain doesn't work there because Gemini's chat interface doesn't give its code execution sandbox network access to reach outside sites. But the encryption trick still let researchers sneak past Gemini's safety filters to get instructions for building an incendiary weapon, a narrower but still serious failure.

A pattern, not an isolated bug

This lands in the same week researchers disclosed a comparable exploit against Microsoft 365 Copilot for enterprise, according to Ars Technica, where a similarly hidden instruction caused the assistant to leak a password sitting in a user's inbox. LLMs don't actually solve prompt injection, they just get guardrails bolted on after the fact, which is comparable to putting a guardrail on a dangerous road curve instead of fixing the curve itself.

There's also a separate, related problem with Grok specifically. Cybersecurity firm ThreatDown, in research covered by SiliconANGLE, found that a criminal service called Kriminal, sold openly on the clearnet starting at $12.99 a month, is built almost entirely on rented Grok access with its safety guardrails stripped by a jailbreak system prompt. ThreatDown said Kriminal's own code identifies Grok, labeled "NEXUS" internally, as the backbone handling chat and agent tasks, while Anthropic's Claude and other models fill narrower roles. That's a distinct issue from the data-exfiltration bug Adversa found, but both point to the same underlying reality: the guardrails wrapped around Grok are being routinely defeated, whether by criminals renting access at scale or by researchers demonstrating theft of ordinary users' private conversations.

xAI has not published a fix, a CVE, or a public statement addressing Adversa's findings as of this writing. Whether the company issues one, and how fast, remains an open question for the millions of people who use Grok's web chat without knowing their session data can reportedly be siphoned off by summarizing the wrong page.