Encrypted web page payload turns Grok into a chat history leak

Grok is still handing users’ private chat data to hackers, according to a report from Adversa AI published on Thursday.

Hackers get ahold of this data through injecting commands in encrypted text that sits in regular-looking web pages. The cybersecurity firm alerted xAI more than two months ago; however, there’s no fix available yet.

Ciphertext flows through Grok’s filter

Adversa researcher Rony Utevsky named the attack “cryptographic context injection.” It passes the chatbot’s own safety filter easily.

Most LLMs filter incoming and outgoing text for suspicious commands. However, this attack hides malicious text from Grok’s filter.

The malicious instruction is encrypted, leaving only the ciphertext, the key, and a note on how to decrypt it on the page.

The filter reads text but never runs it, so ciphertext passes through. Grok then decrypts it inside its code sandbox. It treats the plaintext that pops out as a trusted tool output.

“The runtime execution launders attacker-controlled data into trusted instructions the agent will act upon,” Adversa wrote in its disclosure.

… Continue reading the full article at the original source below.