Encrypted prompt injection: Grok decrypts its own attack, then leaks your chat data
Adversa researchers hid a data-exfiltration payload inside AES-256-GCM ciphertext and let Grok decrypt it inside its own code runtime. The model obeyed instructions it had refused in plaintext, shipping the user's name, location, subscription tier, and chat prompts to an attacker-controlled URL. Reported to xAI in June, it still works as of August 19. Guardrails that scan text, not executed output, are toothless against agentic AI.