Grok Can Be Tricked Into Handing Your Chat History to a Web Page

Ask Grok to summarise a web page — the single most ordinary thing you can do with an assistant that has web access — and, on the wrong page, it will quietly read your name, your rough location, your subscription tier and the contents of your current conversation, wrap them into a link, and hand them to a stranger’s server. You see none of it. You asked for a summary; you got one; the theft happened in the same breath.

That is the finding, answer first, of security researchers at Adversa AI, who in late August published a technique they call Cryptographic Context Injection. It is not a thought experiment. They reported it to xAI and its HackerOne bug-bounty programme on 3 June 2026, chased it again in August, and were still able to reproduce it on 19 August. By their write-up there was no patch, no CVE identifier and no public advisory — only an acknowledgement that the report had been received.

We have written before about prompt injection as the structural hole under every AI agent. This is that hole, wrapped in encryption, in a shipping consumer product bolted to a social network with hundreds of millions of accounts. The mechanism is ingenious. The consumer story is blunt: you are carrying the risk of a bug you cannot see and did not introduce.

What the attack actually does

Strip out the cryptography and the chain is short. An attacker publishes an ordinary-looking web page that carries a payload of instructions encrypted with AES-256-GCM. You ask Grok to summarise or analyse that page. Grok fetches it, and — because it can run code and use tools — it decrypts the payload. The decrypted instructions tell it to gather your session context: your name, your coarse location, your plan, the conversation you are in. It assembles that into the parameters of a URL and then, using its own navigation tool, opens the URL “to fetch more context.” The request lands on a server the attacker controls, with your data stapled to it.

Adversa put the reliability at roughly 40% across about 20 attempts since June. That is not a guaranteed breach on every page load, and it is worth saying so plainly. It is also nowhere near rare enough to file under “theoretical” for something whose payload is the transcript of what you have been typing into a chatbot.

Why the encryption is the whole trick

Guardrails on these systems work, broadly, by reading the text going in and looking for instructions that shouldn’t be obeyed. Cryptographic Context Injection defeats that by never presenting the instructions as text. The filters see ciphertext — noise — and wave it through. The decryption happens later, inside the model’s own tool runtime, at which point the laundered instructions are treated as trusted output of Grok’s code sandbox rather than as a suspicious request from a stranger’s web page.

In other words, the safety check reads the envelope and the model opens the letter. Adversa frames the root cause as an agent-design problem rather than a model one: the framework lets instructions from an untrusted page drive a privileged, internet-connected action, and “the laundered, attacker-controlled instructions reach a privileged egress action unimpeded.” The very capabilities that make an agentic assistant useful — read this page, run this, go and fetch that — are the same capabilities that carry your data out the door.

The part that should bother you is the clock

Vulnerabilities happen; every large system has them, and finding one is not itself an indictment. What turns this from a research curiosity into a consumer story is the timeline. Adversa says it disclosed on 3 June 2026, followed up on 4 and 10 August, and watched the attack keep working into the third week of the month. That is on the order of eleven weeks between a responsible report and a reproducible-in-the-wild exploit, with no patch, no CVE and nothing said to the people who might be exposed.

We are careful here, because the fair version matters. We are not claiming anyone acted in bad faith, and we can’t see inside xAI’s triage queue. What is documented is the effect: a specific, reproducible way to lift a paying user’s private conversation sat open for months while the product kept being sold as an always-on, agentic assistant you are encouraged to point at the whole web. That is a choice about where risk sits, and for now it sits with the user, silently.

Sold as the assistant that does more, not less

Part of what makes this sting is the distance between the pitch and the posture. Grok is marketed as the bold, agentic, always-on assistant — the one wired into a live social network, encouraged to read the web in real time and act on what it finds. That is the product’s whole personality: it reaches further and hesitates less. The awkward truth is that “reaches further” and “can be steered by a stranger’s page into reaching into your account” are the same capability described from two directions.

The more an assistant is designed to fetch, browse and run without stopping to ask, the larger the surface an attacker gets to aim at — and the less the user is placed to notice when that surface is turned against them. Capability sold as convenience is also capability sold as exposure; the launch material only ever mentions the first half. An assistant that will happily go and open a URL on your behalf is, by the same token, an assistant that can be told to open a URL with your secrets attached.

The steel-man, because it’s owed

To be fair — and we insist on it — prompt injection of this family is a genuinely unsolved problem across the industry, not a special failing of one company. It is hard precisely because the model is supposed to follow instructions, and telling “instructions I should obey” from “instructions an attacker planted” is the open research question of agentic AI. Adversa tested the same idea against Google’s Gemini, and reports that by August its success rate had fallen sharply — which cuts two ways. It shows the bug is not unique to Grok, and it shows the class is mitigable, because someone appears to have mitigated it.

Credit where it is due, too: Adversa withheld the working payloads rather than dropping them for anyone to copy, which is the responsible way to publish. And there is a real, honest debate about disclosing a live, unpatched flaw at all. Concede all of that. The narrow complaint still stands, and it is pro-consumer rather than sensational: a reproducible route to exfiltrate a user’s chat existed for months in a mass-market product, the vendor was told through the proper channel, and the exposed users were neither warned nor handed a workaround.

What this costs the person using it

The abstraction hides where the bill lands. In concrete terms:

• Your chat history is not trivia. People paste medical questions, work secrets, relationship details and half-formed opinions into these boxes precisely because they feel private. This turns that transcript into an outbound payload.
• Name plus location plus plan is deanonymising. Even “coarse” location, attached to a real name and account tier, is more than enough to identify a specific person — and to target them next.
• There is no click to blame. The trap is on the page, so “don’t click suspicious links” doesn’t cover it; a shared article or an embedded summarise request can be the delivery.
• There is no signal. Nothing in the interface tells you the summary you requested also mailed your conversation elsewhere. You cannot notice what you cannot see.
• The fix is not yours to make. This is a property of how the assistant wires its tools together, which means no setting you toggle fully closes it. You are dependent on the vendor to act.

What you can actually do

Until there is a confirmed patch, treat any web-connected assistant the way you would treat running a stranger’s script: with suspicion. Be wary of asking Grok — or any browsing assistant — to summarise or analyse pages you did not write, especially links handed to you, and doubly so while you are logged in with a history worth stealing. Assume “summarise this link” can mean “execute what this link says.” Keep less in your active conversation than you think you need to, and clear history you don’t want leaving the building. Where you can, prefer setups that isolate browsing from your account context, and watch for an xAI advisory or patch before relaxing any of this.

The broader lesson is one we keep relearning: the more of the web an assistant is allowed to touch on your behalf, the more the data it holds becomes a target, and the more the industry’s enthusiasm for hoovering up your context collides with its ability to protect it. The demo is a tidy summary. The fine print, this month, is your conversation — addressed, stamped and posted to someone you have never met.