AI safety systems often rely on “guardrails” that decide whether a prompt is risky before anything dangerous happens. A new research report, however, outlines a technique that tries to slip past that layer by changing how the prompt is represented. The approach is called Cryptographic Context Injection, and it targets both direct chat interactions and agent-driven workflows.
In plain terms: instead of sending an obviously malicious sentence, an attacker can deliver encrypted text that the safety layer may not recognize as harmful. Once inside a model’s execution environment, the content can be decrypted and turned into instructions that the system or its tools follow.
What “Cryptographic Context Injection” is
According to the researchers, safety guardrails typically classify prompt text without executing it. They cannot interpret ciphertext as a harmful instruction, so the encrypted content can pass through the filtering stage. The payload then runs inside a code execution sandbox, where the encrypted block—including an instruction and a decryption method—can be handled as part of the runtime process.
After decryption, the model may end up with the recovered plaintext instructions inside a “trusted” execution context. At that point, the guardrails may not reassess the now-decrypted prompt for safety, which can allow the attack to continue.
The researchers also warn that the attacker’s payload can gain credibility through formatting and indirect handling. Text that would likely be flagged if pasted directly into a prompt may become less suspicious when delivered in encrypted form and only transformed later.
Why guardrails struggle with encrypted instructions
The core issue is timing and scope. Many safety systems evaluate inputs before any code execution happens. When a prompt is encrypted, the filter effectively sees only non-interpretable data. Because the guardrails are not designed to decrypt and then rescan the recovered content, the “real” instruction can appear only after the safety checks are over.
The result is a separation between what the safety layer reviews and what the execution environment ultimately uses. If the system decrypts the ciphertext and then proceeds with the resulting instructions without re-running safety classification, harmful behavior can occur.
Importantly, the technique is not limited to one interface. The report describes how encrypted content can be delivered directly to a chat as well as indirectly via a website that an agent is asked to visit and process.
How encrypted payloads reach an AI agent
Encrypted prompts may be delivered in two main ways.
- Direct delivery: An attacker sends ciphertext that includes decryption instructions. When the chat is configured to run code or handle such payloads, the decrypted prompt can be recovered and executed.
- Indirect “watering hole” delivery: An attacker hosts a web page that contains an encrypted JSON object plus instructions for decrypting it. The victim is then lured into having an agent examine or summarize the page. That agent ingests the encrypted data and triggers the decryption flow.
In the indirect scenario, the attacker is effectively steering the agent’s attention to untrusted content. Once the agent processes the page, encrypted instructions can be transformed into actionable steps.
Grok example: agentic browsing and zero-click exfiltration
The researchers provide an example targeting the xAI Grok web chat environment and its agentic browsing framework. The scenario is described as a zero-click data exfiltration attack facilitated through social engineering: the target is persuaded to review a weaponized web page.
That web page contains an encrypted JSON object along with instructions to decrypt it using the agent’s Python runtime. After decryption, the plaintext prompt can instruct the agent to recover private session context. The output is then embedded into a URL controlled by the attacker.
From there, the attacker’s URL is loaded autonomously, and the victim’s data can be transmitted without the user’s involvement at the crucial moment. The researchers emphasize that the framework can allow instructions and data parsed from an untrusted external page to drive invocation of a privileged, internet-connected tool.
They further explain that private session metadata and conversation history can be resolved into inputs for an outbound action. The key concern is that the attacker-controlled instructions reach an egress-capable step without user confirmation or visible warning.
Gemini example: direct injection in a “Deep Thinking” mode
The report also describes a Gemini public chat example in a mode described as “Deep Thinking.” Here, the attack can be initiated with a single prompt that instructs Gemini to run a Python script to decrypt provided ciphertext.
Through a set of tactics outlined by the researchers, the decrypted prompt can lead the model to generate restricted content while attempting to “frame” it as something that will be encrypted “for safety.” The workflow described is cyclic: prohibited data is produced, encrypted, and returned to the user.
The researchers comment that the technique produced multi-paragraph examples of restricted content that safety filters normally suppress. They also note that the malicious prompt and dangerous output both defeat the input and output safety guardrails by relying on encryption and delayed transformation.
Is the attack still effective?
When the researchers published the report, they indicated they had disclosed their findings to xAI on June 3, 2026, and attempted to coordinate disclosure later. At the time of writing, they had not received a response.
They also state that the attack’s success against Gemini was falling by August. The report does not claim a definitive cause, suggesting the change may relate to filter updates, model version differences, or both.
Still, the researchers treat the technique as a serious risk because, even if success rates decline, the underlying approach remains conceptually viable—especially as agent capabilities become more powerful and more integrated into workflows.
Limits on disclosure to other platforms
The researchers note they could not disclose their findings to Google under its vulnerability disclosure program, at least as they understood it, because jailbreak-style issues fall outside scope for that program.
Even so, the team decided to go public, driven by the ongoing potential danger of Cryptographic Context Injection and the defensive guidance included in their report.
Defenses: what to do as a defender
While the source article focuses on the attack concept and examples, it also mentions that the researchers included prevention advice for defenders. Based on the described failure pattern, effective defenses generally need to address the “decrypt then re-check” gap.
In practical terms, teams building AI applications can consider measures such as:
- Re-scanning decrypted content: If the system decrypts ciphertext or reconstructs hidden text, safety checks should run on the recovered plaintext as well.
- Restricting tool access for untrusted inputs: Agent tool invocation should be limited when the driving instructions originate from external, untrusted sources.
- Adding visibility and confirmation: High-risk actions—like outbound requests or context export—can require extra scrutiny or user confirmation to reduce silent exfiltration.
- Reducing the impact of untrusted browsing: Agents that read pages from the open web should treat embedded data as potentially hostile, even if it appears structured (for example, JSON).
Because Cryptographic Context Injection is designed around guardrails that happen before execution, defenders should ensure safety controls cover the post-transformation stage too.
Related threat context: prompt injection is evolving
This report arrives alongside broader concerns about prompt injection and agentic attacks. Earlier research discussed how malicious instructions can trick AI agents into performing harmful actions, including financial or operational misuse. The distinctive feature here is the use of encryption to delay recognition, making the attack look harmless at the moment of filtering.
As a result, security strategies that focus only on obvious “jailbreak text” may miss attacks that conceal intent until after the model enters an execution phase.
Conclusion
Cryptographic Context Injection highlights a clear weakness in many AI safety pipelines: encryption can cause harmful instructions to evade classification until after safety checks have already passed. The researchers describe examples involving agentic browsing in Grok and direct prompt decryption in Gemini, including scenarios that could enable unauthorized data access or restricted-content generation.
Even if defenses improve and success rates drop over time, the underlying concept remains a warning sign for anyone deploying AI agents with code execution or internet-connected tools. The safest path is to extend safety validation beyond the initial input and make sure decrypted or reconstructed instructions are evaluated before any sensitive action occurs.
Source: https://www.securityweek.com/encrypted-prompts-bypass-ai-safety-guardrails-in-grok-and-gemini/
