Encryption becomes a weapon: researchers bypass AI safety filters by hiding attacks in ciphertext

Adversa, an AI security firm, has uncovered a clever weakness in how AI safety systems work: by encrypting attack payloads with AES-256-GCM, researchers convinced xAI's Grok to decrypt and follow malicious instructions that it would have rejected if presented in plain text. The technique, tested on Grok 4.5 Fast starting in June, succeeded in 40% of attempts.

How the attack works#

The researchers embedded encrypted data, decryption keys, and instructions on a webpage. When a user asked Grok to summarize the page, the model used its Python code execution environment to decrypt the payload—generating plaintext that included commands to steal session information. Grok then extracted sensitive user data (name, location, subscription tier, conversation history) and packaged it as parameters in a URL pointing to an attacker-controlled server, exposing the information without user approval.

The same data-exfiltration attack failed when presented in plain text, suggesting that Grok's security filters inspect text entering and leaving the model but may not scrutinize plaintext generated by its built-in tools.

Why static filters fall short#

According to Adversa lead researcher Rony Utevsky, the problem lies with how security guardrails work: they classify text rather than execute it. A filter can spot ciphertext, encryption algorithms, and key material on a webpage, but determining what they decrypt requires actually performing the computation. By the time Grok completes that decryption, the initial inspection is already done—and the malicious instructions are now labeled as runtime output from an approved tool, not user input.

Broader implications for agentic AI#

This vulnerability reflects a wider risk in AI agents: security checks at the input layer only tell part of the story. Tool outputs, intermediate data, and runtime results can introduce fresh attack surfaces. When agents access private information and can communicate with external systems, compromised execution paths threaten not just what the model says, but what the system actually does.

Adversa tested a variant of Cryptographic Context Injection on Google's Gemini by formatting decrypted content to resemble a Python error traceback. The researchers sidestepped Gemini's safety controls by instructing the model to act on the fabricated error, causing it to generate blocked content and reveal system instructions. Because Google's vulnerability disclosure program excludes jailbreaks, the researchers did not report their Gemini findings, though they note the model has since become more resistant to the technique.