Cryptographic context injection
What it is
An evasion technique for prompt injection where the attacker hides malicious instructions inside ciphertext (plus a decryption key) embedded in a web page or other content an AI agent processes. A guardrail or safety scanner inspecting the raw input can't read the encrypted payload, so it passes through unflagged — but the model itself decrypts it while doing its normal work, and then treats the decrypted text as trusted output from its own execution rather than as untrusted external data. The model acts on the attacker's instructions without any confirmation step.
Why it's emerging now
As agents combine language understanding, tool/code execution, and real-world permissions (sending data, calling APIs) with growing use of input-side guardrail scanners to catch prompt injection, a gap opened up: anything that fools the scanner but not the model slips through entirely. Security researchers at Adversa AI disclosed a working exploit against xAI's Grok — reported to xAI on June 3, 2026 — that let an ordinary web page exfiltrate a user's name, location, subscription tier, and live conversation to an attacker-controlled server when Grok was asked to summarize the page. Coverage broke widely in the third week of August 2026 (The Hacker News, The Register, SC Media, Dataconomy) after the vulnerability remained unpatched for months, which is what put the term in front of a broad audience this week.
How it relates to what you know
It's a specific, more sophisticated descendant of prompt injection / jailbreaking (already on the ledger) — the same "attacker-controlled content becomes attacker-controlled instructions" pattern, engineered specifically to defeat the increasingly common practice of scanning inputs for injection attempts before they reach the model. It underscores a known weak point in that defense: a scanner and a model don't necessarily see the same thing.