Researchers hid an attack inside AES encryption. The AI model cracked it open willingly.

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Security filters are designed to catch malicious instructions before an AI model can act on them. Researchers at AI security firm Adversa found a way around that assumption by giving the model an encrypted payload and letting it create the malicious instructions itself.

In an attack demonstrated against xAI’s Grok, the model rejected data-exfiltration instructions when they appeared on a webpage in plain text. But when researchers encrypted the same payload with AES-256-GCM and supplied the information needed to decrypt it, Grok generated the plaintext inside its code execution environment and followed the instructions.

Adversa tested the technique, they named Cryptographic Context Injection, against Grok 4.5 Fast on Wednesday. The company says it has attempted the attack 20 times since June with a 40% success rate.

Grok decrypted the attack itself

The webpage used in Adversa’s demonstration contained ciphertext, PBKDF2 parameters, AES-256-GCM key material and instructions for decrypting it. When a user asked Grok to summarize the page, the assistant ran the decryption inside its Python code execution environment.

Once decrypted, the payload told Grok to retrieve information from the user’s session, including their name, approximate location, subscription tier and conversation prompts, and package it into what appeared to be another decryption key. In reality, it was a string containing the user’s session data.

Grok was then instructed to add that string to the query parameters of an attacker-controlled URL and visit it using its navigation tool. The request exposed …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://thenewstack.io/encrypted-prompt-injection-grok/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.