Encrypted prompt injection: your guardrail reads ciphertext

Every AI guardrail we've seen deployed works the same way: a classifier reads the text going into the model and blocks the bad stuff. On August 20, Adversa AI published research showing how to walk straight past that with a technique that would be funny if it weren't so obvious in hindsight. Encrypt the malicious instructions. Put the key on the same page. The scanner sees noise. The model does the decryption itself — and then obeys what it just produced.

What actually happened

Researcher Rony Utevsky at Adversa AI calls it cryptographic context injection. An attacker plants a web page containing an encrypted JSON blob, the key material, and a plain-English instruction telling the model to decrypt it. When a user asks an AI chat agent to read that page, the content classifier inspects the fetched data and finds an unreadable ciphertext — nothing to flag. The model then runs PBKDF2 and AES-256-GCM in its own Python runtime, recovers the plaintext instructions, and treats its own output as trusted input.

The Register's writeup puts the asymmetry cleanly: everything a scanner would need is right there on the page, but recovering the plaintext means actually running the crypto — which the scanner doesn't do and the model happily does. Utevsky's framing of the root cause: "The model trusts its own output, namely the malicious instructions that it decrypted."

The proof of concept targeted Grok.com. The decrypted instructions told the agent to build a "decryption key" that was really a template string stuffed with the user's session data — name, coarse location, subscription tier, and the full set of prompts in the conversation — then hand it to Grok's navigation tool, which sent it to an attacker-controlled server as URL query parameters. Adversa reports a 40% success rate across 20 attempts since June, per The Hacker News.

The disclosure timeline is the other story. Adversa reported it to xAI on June 3, 2026, followed up on August 4 and again on August 10, and reproduced the attack on August 19. xAI acknowledged the report without a mitigation timeline and then stopped responding. Adversa published on August 20 with no patch and no advisory.

Why prompt injection defenses matter for your business

You probably don't run Grok. You very likely run something that fetches a web page, reads a PDF, or pulls a support ticket into a model's context — and you may have bought a guardrail product to make that safe.

A content classifier is a text filter. It inspects an artifact at rest. It cannot inspect the program your model assembles at runtime out of its own tool outputs, its own code execution, and its own intermediate reasoning. Encryption is just the cleanest demonstration; base64, a homebrew cipher, or instructions split across two fetched documents produce the same effect. Utevsky said as much — whether a weaker encoding also slips past a given filter is an empirical question, not a settled one.

So stop treating the filter as the control. Three things actually reduce your blast radius:

Untrusted content never reaches a tool-using agent unsupervised. If the model can browse and also has a tool that makes outbound requests, you have an exfiltration path. Separate the two: one agent reads and summarizes with no network egress, a second acts on the summary.

Egress is an allowlist, not a filter. The PoC leaked data by appending it to a URL. If your agent's HTTP tool can only reach hosts you named, that attack returns nothing regardless of what the model was talked into.

Assume the model will be convinced. Design as if an attacker gets one free instruction into every agent run, then ask what that instruction can reach. If the answer is "the whole customer table," the problem isn't the guardrail — it's the permissions underneath it.

There's a vendor lesson here too. Seventy-eight days from a credible report to publication with no patch and no advisory is a data point about a supplier, not just a bug. Ask your AI vendors what their disclosure SLA is before you find out this way.

Sources: The Register, The Hacker News.