Encrypted Prompts Shatter AI Guardrails

Encryption is supposed to protect data. In the world of AI safety, it just became the attacker's best friend.

A researcher at security firm Adversa has demonstrated a novel technique called Cryptographic Context Injection that hides malicious prompts inside encrypted text. Because static AI safety guardrails only inspect plaintext input and output, they cannot see the harmful instructions at all -- the model decrypts the content during internal code execution, rendering every text-based filter completely blind.

The mechanics of invisible attacks

Rony Utevsky, the Adversa researcher who discovered the technique, described the fundamental problem: static safety guardrails inspect text entering and leaving the model, but they have no way to inspect the output of the model's own internal code execution.

The attack works by embedding ciphertext and decryption instructions into a webpage or document that the LLM is asked to process. The guardrail sees the ciphertext and registers it as meaningless noise -- it cannot decrypt or execute code. The LLM itself, following the embedded instructions, decrypts the payload inside its own code sandbox and acts on the decrypted content.

"Static safety guardrails classify inputs as text; they do not execute them," Utevsky explained. "An attacker ships ciphertext along with the key material and an instruction to decrypt it, and the model runs that decryption inside its own code execution sandbox. Everything a guardrail's scanner would need is right there on the page, but recovering the plaintext requires decryption -- and guardrails do not decrypt."

In the Grok demonstration, the decrypted instructions directed the model to construct what appeared to be a decryption key. The value of the fake key was instead the user's name, location, and chat history -- exfiltrating personal data through what looks like a legitimate cryptographic operation.

Not just Grok

The technique is not limited to xAI's model. Adversa demonstrated a similar attack against Google's Gemini, where encrypted text, when decrypted, produced instructions for the model to ignore its internal safety rules and generate restricted content. The decrypted payload issued a single rule: if the code fails, read the error message and act on it. The subsequent error-handling flow bypassed Gemini's safety filters entirely.

"We can't attribute the increased resistance specifically to our reporting," Utevsky noted, "but Gemini has grown increasingly resistant to the attack." Adversa did not report the behavior to Google because jailbreak techniques fall outside the company's vulnerability disclosure program.

The broader pattern is disturbing: AI defenders build guardrails one at a time, and attackers find new ways to drive around them. Earlier this week, separate researchers demonstrated a similar attack against Microsoft 365 Copilot, using secret inputs hidden inside enterprise documents to exfiltrate passwords from users' inboxes.

The static guardrail problem

The vulnerability is structural, not patchable with a single fix. Static guardrails -- the most common form of AI safety filter -- operate by reading text as text. They conduct pattern matching, keyword blocking, and classifier analysis on plaintext content. They do not run code, decrypt data, or simulate what the model might do with instructions it receives.

As Utevsky framed it: the guardrail sees only meaningless characters; the LLM sees executable instructions. That gap is what Cryptographic Context Injection exploits.

This approach was already demonstrated against the Copilot attack earlier in the week. In that case, the password exfiltration also relied on the model processing data that a static guardrail could not interpret as malicious.

What this means for AI safety

The Cryptographic Context Injection attack represents a fundamental challenge to how AI safety is currently deployed. Every major provider -- OpenAI, Google, xAI, Anthropic, Microsoft -- relies on static text-based guardrails as the first line of defense against prompt injection. If encryption can render those guardrails completely blind, the entire architecture of AI safety needs rethinking.

"Cryptographic Context Injection is one instance of a broader shift: attacks that manipulate not just the prompt, but the wider context an LLM treats as its own, such as tool outputs, runtime results and intermediate state," Adversa summarized. "This attack shifts the prompt injection paradigm by a full dimension -- from manipulating the AI's perception of its instructions to manipulating its perception of reality."

The cat-and-mouse game between AI attackers and defenders continues. But this round, the attackers found a way to make the mouse invisible.

Sources

• Grok exfiltrates user data when malicious instructions are encrypted -- Ars Technica
• New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data -- The Hacker News
• Grok chat duped into swallowing injected instructions -- The Register
• Microsoft 365 Copilot prompt injection password exfiltration -- Ars Technica