A researcher at the AI red-teaming firm Adversa demonstrated a technique called Cryptographic Context Injection that gets xAI Grok to leak a user chat history and personal details simply by asking it to summarize an ordinary-looking web page. The trick exploits a structural blind spot in how safety guardrails work: most prompt-injection filters scan incoming text for suspicious instructions, but they only look at plaintext. The attacker embeds malicious instructions on a page encrypted with a simple cipher such as AES, along with the decryption key in plain sight. Grok input filter sees only ciphertext, which looks like meaningless noise and passes review, but the model itself is capable of decrypting it once asked to process the page, at which point it treats the now-decrypted instructions as legitimate content to act on inside its own trusted execution context, including exfiltrating the user name, approximate location, subscription tier and current conversation to an attacker-controlled server, without any confirmation prompt. It matters for people building on top of LLMs because it shows that filtering user-facing input for malicious patterns is not sufficient once a model has general-purpose reasoning and code-execution-like abilities such as decoding ciphertext or unpacking obfuscated payloads; any of those transformations can smuggle instructions past a filter that only understands the surface form of the text. Adversa reported the issue to xAI in early June 2026 and followed up multiple times through August, and as of August 19 the technique was still working against the live Grok.com product with no fix or mitigation timeline given. Teams building agents that browse or summarize arbitrary web content should treat this as a concrete argument for defense-in-depth: sandboxing what a model is allowed to act on after decoding content, not just what it is shown before decoding it.