Researchers hid an attack inside AES encryption. The AI model cracked it open willingly.

AI security filters usually try to catch bad instructions before a model can act on them. Adversa found a cleaner way around that idea: give the model an encrypted payload, plus the pieces needed to decrypt it, and let the model generate the dangerous text on its own.

In the company’s test against xAI’s Grok 4.5 Fast, the assistant refused the same data-theft instructions when they were written plainly on a webpage. But when Adversa wrapped them in AES-256-GCM and included PBKDF2 parameters and key material, Grok ran the decryption inside its Python code execution environment and then followed the result. Adversa says it has tried the technique 20 times since June and gotten a 40% success rate.

The webpage in the demo was doing a lot of work. It held ciphertext, the decryption setup, and the instructions for turning that into readable text. After a user asked Grok to summarize the page, the model decrypted the payload and was told to pull details from the user’s session, including name, approximate location, subscription tier and conversation prompts. Those details were then disguised as if they were a decryption key, added to the query string of an attacker-controlled URL, and sent out through Grok’s navigation tool. The attacker could then capture the exposed data in server logs, and the user never had to approve the request.

Adversa’s theory is that Grok filters text entering and leaving the model, but not plaintext returned by its code execution environment. If that’s right, the malicious content changes form mid-flight. It starts as ciphertext on a page, gets decrypted inside a sanctioned tool, then comes back as runtime output and slips past a guardrail that only classifies text. Rony Utevsky, Adversa’s lead researcher, says that’s the weakness of static defenses: they can inspect the inputs, but they can’t know what the computation produces without actually doing the computation first.

The same basic problem shows up beyond Grok. Adversa has also tested a variant against Google’s Gemini by shaping decrypted content to look like a Python traceback, which pushed the model into generating content its safety rules would normally block. A tweaked version got Gemini to reveal internal system instructions. The researchers didn’t report that case to Google because jailbreaks aren’t covered by its disclosure program, and they say Gemini has since become harder to trick, though they don’t know whether the change was in the model, the filters, or both.

The uncomfortable part is that this isn’t just about what the model says. Grok had access to private session data and a tool that could talk to an outside server. Once the navigation tool made the request, the data left the system. That gives developers another place to enforce policy, and a strong argument for watching the exact arguments sent to tools, not just the text that enters the model in the first place.