Cryptographic Context Injection: Zero-Click Grok Chat History Theft — Detection and Defense Guide for AI-Integrated Environments

Adversa AI researcher Rony Utevsky has disclosed a new attack technique dubbed Cryptographic Context Injection, demonstrated against xAI's Grok, that achieves zero-click theft of a user's complete chat history. The technique sidesteps AI safety filters by delivering malicious instructions as AES-encrypted ciphertext and manipulating the model into decrypting and executing those instructions inside its own code execution runtime. Because the payload is ciphertext at the point of ingestion, content filters and prompt-injection classifiers see only inert data — the malicious logic only materializes after the model itself has decrypted it.

This matters well beyond Grok. Any LLM deployment that combines (a) access to sensitive conversational or enterprise context and (b) a code execution tool — interpreter, sandbox, notebook, or agent runtime — presents the same structural attack surface. For organizations integrating AI assistants into workflows handling PHI, PCI data, source code, or incident details, this is a live data-exfiltration risk vector that bypasses the guardrail layer most teams are relying on as their primary control. Defenders need to treat model-accessible code execution as a privileged execution environment and instrument it accordingly.

Technical Analysis

Affected platform: xAI Grok, specifically configurations where the model has access to a code execution runtime (code interpreter / tool-use capability). The research was demonstrated against Grok; the technique class applies to any LLM with a decrypt-capable code execution tool and access to sensitive context.

CVE / CVSS: No CVE has been assigned as of this writing. This is a technique disclosure against AI application architecture, not a patched software flaw.

Attack chain, from the defender's perspective:

1. Payload delivery (zero-click). The attacker embeds AES-encrypted ciphertext containing malicious instructions into content the model will ingest — a prompt, an attached document, a web page, or any retrievable data source. "Zero-click" means the victim does not need to perform any overt action; ingestion of attacker-controlled content into the model's context is sufficient. This aligns with indirect prompt injection delivery patterns (MITRE ATLAS AML.T0051).

2. Guardrail bypass via encryption. Safety filters operating on plaintext prompts evaluate ciphertext as harmless opaque data. Semantic classifiers, keyword blocklists, and injection detectors have nothing to match against.

3. In-runtime decryption. The injected plaintext instructions direct the model to use its code execution runtime to decrypt the payload — i.e., the model itself writes and runs the decryption routine (typically Python with a crypto library such as Crypto.Cipher/cryptography). The malicious instructions only exist in plaintext inside the execution environment, downstream of every input filter.

4. Context access and exfiltration. Once decrypted, the instructions direct the runtime to collect conversation history / session context and transmit it to attacker-controlled infrastructure — via HTTP(S) requests, DNS tunneling, or other egress channels available to the sandbox.

Exploitation status: Working proof-of-concept demonstrated by Adversa AI against Grok. No confirmed mass exploitation in the wild at time of writing, but the technique is now public, requires no specialized tooling beyond standard crypto libraries, and generalizes to other LLM platforms. Treat as an active technique, not a theoretical one.

Why this defeats common controls:

• Input-side prompt-injection filters never see plaintext instructions.
• The decryption step uses legitimate functionality (a code interpreter running Python) — there is no "exploit" in the traditional memory-corruption sense to signature against.
• Exfiltration rides normal HTTPS egress, indistinguishable from legitimate tool-use traffic without behavioral baselining.

The control gaps are architectural: unrestricted egress from code execution sandboxes, lack of inspection of what the runtime is instructed to do, and absence of monitoring on model-initiated network activity.

Detection & Response

Detection for this threat class lives at two layers: (1) the endpoint/telemetry layer, where AI tooling runtimes (Python, Node, browser-hosted agents) spawn decryption and network activity, and (2) the network layer, where sandbox egress to non-allowlisted destinations is the strongest signal. Rules below target the observable behaviors: crypto-library usage invoked from AI-adjacent runtimes, and interpreter processes initiating outbound connections.

---
title: AI Code Runtime Crypto Decryption Activity
tid: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects Python/Node interpreter invocations referencing AES decryption routines, consistent with Cryptographic Context Injection payloads that trick LLM code-execution runtimes into decrypting embedded ciphertext instructions.
references:
  - https://securityaffairs.com/197717/hacking/zero-click-grok-chat-history-theft-adversa-ai-demonstrates-cryptographic-context-injection.html
  - https://attack.mitre.org/techniques/T1059/006/
  - https://atlas.mitre.org/techniques/AML.T0051/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_interpreter:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_crypto:
    CommandLine|contains:
      - 'Crypto.Cipher'
      - 'AES.new'
      - 'AES-256-CBC'
      - 'Fernet('
      - 'decrypt('
      - 'createDecipheriv'
  selection_encoding:
    CommandLine|contains:
      - 'base64'
      - 'b64decode'
      - 'unhexlify'
      - 'fromhex'
  condition: selection_interpreter and selection_crypto and selection_encoding
falsepositives:
  - Legitimate developer decryption tooling and secrets-management scripts
  - Internal automation using AES for data handling
level: medium
---
title: Interpreter or AI Agent Runtime Initiating Outbound Web Connection
tid: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects script interpreters or AI tool runtimes establishing outbound HTTPS connections to non-standard destinations, consistent with exfiltration of LLM chat history or session context following in-runtime payload decryption.
references:
  - https://securityaffairs.com/197717/hacking/zero-click-grok-chat-history-theft-adversa-ai-demonstrates-cryptographic-context-injection.html
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
      - '\curl.exe'
      - '\powershell.exe'
    DestinationPort:
      - 443
      - 8443
      - 8080
  filter_known_services:
    DestinationHostname|contains:
      - '.pypi.org'
      - '.npmjs.org'
      - '.github.com'
      - '.microsoft.com'
      - '.windowsupdate.com'
      - '.x.ai'
      - '.openai.com'
      - '.anthropic.com'
  condition: selection and not filter_known_services
falsepositives:
  - Package managers and developer tooling reaching third-party CDNs
  - Legitimate AI plugins calling external APIs — tune the filter list per environment
level: high

// Hunt: script interpreters / AI runtimes making outbound connections to rare destinations
// Consistent with exfiltration following Cryptographic Context Injection (decrypt-in-runtime, then egress)
let Lookback = 7d;
let AllowedSuffixes = dynamic(["pypi.org","npmjs.org","github.com","microsoft.com","x.ai","openai.com","anthropic.com"]);
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName in~ ("python.exe","python3.exe","node.exe","powershell.exe","curl.exe")
| where RemotePort in (443, 8443, 8080)
| extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
| where not(RemoteUrl has_any (AllowedSuffixes))
| summarize ConnectionCount = count(),
            FirstSeen = min(Timestamp),
            LastSeen = max(Timestamp),
            Devices = dcount(DeviceName),
            SampleCmd = any(InitiatingProcessCommandLine)
    by RemoteUrl, RemoteIP, InitiatingProcessFileName
| where ConnectionCount < 50   // rare destinations are higher-signal
| order by ConnectionCount asc;

-- Hunt: interpreter processes with crypto + encoding artifacts in command lines
-- or live outbound connections, consistent with decrypt-then-exfil behavior
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|node|powershell'
  AND CommandLine =~ '(?i)AES|decrypt|Fernet|b64decode|unhexlify|fromhex|createDecipheriv'

-- Correlate with live network connections from interpreter processes
SELECT Pid, Name, ProcessExe, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)python|node'
  AND RemotePort IN (443, 8443, 8080)
  AND NOT RemoteAddress =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

# AI Runtime Egress Hardening — restrict interpreter/sandbox outbound traffic and audit AI tool usage
# Run as Administrator. Review paths and allowlists before applying to production.

# 1. Block direct outbound HTTPS from script interpreters not behind the corporate proxy
$interpreters = @(
  "$env:ProgramFiles\Python*\python.exe",
  "$env:LOCALAPPDATA\Programs\Python\Python*\python.exe",
  "$env:ProgramFiles\nodejs\node.exe"
)
foreach ($pathPattern in $interpreters) {
  Get-Item $pathPattern -ErrorAction SilentlyContinue | ForEach-Object {
    $ruleName = "AI-Egress-Block - $($_.Name) - $($_.Directory.Name)"
    if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
      New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Program $_.FullName `
        -Action Block -RemotePort 443,8443,8080 -Profile Any | Out-Null
      Write-Host "[+] Created block rule for $($_.FullName)"
    }
  }
}

# 2. Enable process creation auditing with command-line capture (needed for the Sigma rules above)
AuditPol /set /subcategory:"Process Creation" /success:enable /failure:enable
$key = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
Set-ItemProperty -Path $key -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -Type DWord
Write-Host "[+] Process creation command-line auditing enabled"

# 3. Verify: list recently created block rules and confirm audit policy
Get-NetFirewallRule -DisplayName "AI-Egress-Block*" | Select-Object DisplayName, Enabled, Action
AuditPol /get /subcategory:"Process Creation"

Remediation

There is no patch to deploy — this is an architectural risk in how AI assistants are integrated. Remediation is layered and control-driven:

Immediate (this week):

1. Inventory AI tool exposure. Identify every LLM assistant, copilot, or agent in use across the organization that has code execution capability and access to sensitive context (chat history, documents, mail, tickets). Include shadow AI — browser-based Grok/ChatGPT/Claude usage on corporate endpoints.
2. Restrict sandbox egress. AI code execution runtimes should have no direct internet egress, or egress limited to an explicit allowlist via proxy. Exfiltration requires a network path; removing it neutralizes the final stage of this attack chain regardless of how the payload arrived.
3. Apply the firewall hardening above to endpoints where local interpreters back AI tooling, and enable command-line process auditing to support detection.

Short term (30 days):

4. Segment context access. Do not grant AI assistants blanket access to full conversation histories, credential stores, or regulated data repositories. Apply per-session scoping and data minimization so a successful injection yields minimal context.
5. Deploy output-side inspection. Since input filters are defeated by ciphertext, monitor what the runtime is instructed to do: flag execution plans involving decryption functions followed by network calls. Several LLM firewall / AI-SPM products now support tool-call inspection — evaluate them.
6. User guidance for zero-click exposure. Because ingestion can be passive (documents, web content, shared chats), treat AI assistants as untrusted-content processors. Prohibit pasting or attaching regulated data into consumer AI tools pending a governance review.

Vendor engagement:

7. Track xAI's response to the Adversa AI disclosure and apply any guardrail or sandbox changes Grok ships. Monitor the original disclosure coverage at the SecurityAffairs article and Adversa AI's publication for follow-on technical detail.
8. Pressure-test your own AI integrations with this technique class (encrypted indirect prompt injection) through authorized red team exercises before adversaries do it for you.

Governance: Map this threat to MITRE ATLAS (AML.T0051 — LLM Prompt Injection) in your threat model, and fold AI-runtime monitoring into existing SOC detections rather than standing up a siloed program. If your organization handles HIPAA or PCI-scoped data through AI assistants, document this technique in your next risk assessment — a zero-click chat-history exfiltration path is a reportable-risk scenario under both frameworks.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub