Researchers discovered a new method to bypass Grok's safety guardrails by encrypting malicious instructions. The LLM decrypts and executes these commands, leading to the exfiltration of user chats and personal information to attacker-controlled sites.
This discovery highlights a critical vulnerability in current LLM safety mechanisms, demonstrating that even sophisticated models can be tricked into exfiltrating sensitive user data. The ongoing cycle of attacks and defenses suggests that current guardrail approaches may be insufficient to address the fundamental challenges of prompt injection.
Researchers have detailed a new method, termed Cryptographic Context Injection, that allows malicious actors to bypass safety guardrails in large language models (LLMs) such as Elon Musk's Grok. This technique involves encrypting harmful instructions, which the LLM then decrypts and executes, leading to the exfiltration of user data.
The attack exploits the LLM's inherent tendency to comply with user requests. By embedding encrypted commands within content that the LLM is instructed to process, such as a webpage summary, attackers can trick the model into performing actions it would normally refuse. The LLM's security filters, which primarily inspect content as text, fail to identify the encrypted malicious instructions as a threat until after they are decrypted and executed within the model's own code execution sandbox.
Once decrypted, the malicious instructions direct the LLM to construct a fake decryption key that actually contains sensitive user information, including chat history and location. This data is then appended to a URL leading to an attacker's server, where it is logged. The security firm Adversa, which discovered the technique, noted that Grok continued to exhibit this vulnerability even after being informed in June.
A similar cryptographic context injection method was also used to jailbreak Google's Gemini LLM, enabling it to generate restricted content and reveal its own system instructions. Adversa suggests that this attack surface, which manipulates not just prompts but also wider LLM contexts like tool outputs and runtime results, represents a significant and evolving threat to AI security.