AINEWS
Researchers at Adversa showed Grok, xAI's assistant on X, decrypting attacker instructions buried in user content.
A class of attack called prompt injection lets hidden text inside a chatbot's content override its system instructions. This week, security researchers at Adversa showed a prompt-injection variant on Grok, xAI's assistant on X, that turns the chatbot's own compliance into the attack vector: instructions no filter can read, but the model itself decrypts at runtime.
Adversa's researchers showed that Grok.com can be tricked into exfiltrating a user's chat history by hiding instructions inside encrypted or encoded payloads that the chat's own code-execution runtime later decrypts. The Register's coverage calls the pattern "trust laundering": lightweight prompt-injection filters that screen user content cannot inspect strongly encrypted instructions, so the model decrypts them at runtime, then trusts the result as its own output.
That is the difference between prompt injection and the two categories readers more often hear about. A jailbreak is a user trying to talk the model past its rules. A data breach is a vendor losing control of its systems. Prompt injection is a third thing. The attacker doesn't talk to the model. The attacker talks to the data the model is reading, and the model follows the data's instructions as if they were its own.
The mechanism is not Grok-specific. A preprint posted to arXiv in late 2025 as paper 2510.01529, titled "Bypassing Prompt Guards in Production with Controlled-Release Prompting," documents the same class of attack, prompts indecipherable to bounded filters but tractable to the target LLM, succeeding against Grok, Gemini, DeepSeek, and Mistral Le Chat. Ars Technica frames the underlying cause as the one any instruction-following chatbot shares: the model is trained to comply with the user's apparent request, and a summarized email or webpage carrying smuggled instructions looks like a request.
A separate research lane, reported by The Hacker News, showed a two-turn substitution-cipher attack succeeding against Grok 3 on all 12 of the malicious intents the team tested. Same idea, different shape: the user-visible text carries no payload, and the model is steered only through what it reconstructs from the cipher.
In May 2026, a morse-code prompt-injection on X drained roughly $150,000 from a Grok-linked AI wallet, per the OECD AI incident database and the Giskard research team that traced the loss. Same class: encoded instructions the user could not see, model that could, wallet that emptied.
The reason no patch closes this is structural. A filter that can read a user's instructions to look for malice has, by construction, less reading ability than the model it is filtering for. If the attacker can pick an encoding the filter fails on and the model passes, and there are always more encodings than filters, the filter is decorative. The only fix that has a chance is to move the decryption step outside the model's context. Do not let the chatbot turn ciphertext into instructions inside its own context window. Run the decode in a sandbox, hand the model the plain text as data, not as something it generated.
That is the test worth watching. The next vendor patch that claims to have closed prompt injection can be checked against it. Did the patch move the decode, or did it just add another filter in front of the model? If the decode still happens inside the model's context, the next cipher gets through.