Adversa AI disclosed a web-based attack technique that allows threat actors to extract sensitive user data from xAI's Grok chatbot through compromised web pages. The attack, dubbed "Cryptographic Context Injection," exploits how Grok processes requests to summarize online content.

When a user asks Grok to summarize a page, the chatbot receives instructions embedded in that page's code. Attackers can craft malicious web pages containing hidden directives that cause Grok to exfiltrate user information to attacker-controlled servers. The compromised chatbot sends the user's name, approximate location, subscription tier, and entire conversation history without the user's knowledge or consent.

The attack requires no authentication bypass or exploitation of unpatched vulnerabilities. Instead, it leverages the trust relationship between Grok and web content. The technique works because Grok processes web page instructions with the same privileges as legitimate summarization requests, creating a context confusion vulnerability.

This class of attack mirrors prompt injection exploits documented against other large language models, but targets the integration layer between AI assistants and external web content. The vulnerability exposes a fundamental architectural weakness in how modern chatbots handle third-party input sources.

Adversa AI's disclosure did not specify whether xAI has patched this vulnerability or implemented mitigations. The company typically collaborates with affected vendors before public disclosure, though no official statement from xAI was immediately available.

Organizations using Grok for business purposes face direct risk of credential leakage and conversation data exposure. Individual users should assume their subscription details and chat histories remain accessible to attackers controlling summary-able web pages. The attack requires no user interaction beyond the legitimate act of requesting a page summary.

This disclosure highlights ongoing challenges in securing AI systems that interact with untrusted external content. As chatbots become integrated into business workflows, the attack