FHN 
A newly reported attack technique shows how an AI assistant can potentially be tricked into revealing sensitive conversation data without requiring the user to click a malicious link or approve an action.
Researchers from Adversa AI demonstrated the technique against Grok’s web interface. The attack starts with something that appears harmless, such as asking Grok to summarize a webpage.
Behind the scenes, hidden instructions on that webpage can attempt to manipulate the AI into processing attacker-controlled commands and sending private session information to an external server.
How the Attack Works
The technique, called Cryptographic Context Injection, hides malicious instructions inside encrypted content.
Instead of placing the attack directly in readable text, the webpage contains encrypted data along with instructions that encourage the AI agent to decrypt it using its available code-execution capabilities.
This approach is designed to bypass traditional prompt-injection filters because the malicious instructions are not visible until they are processed by the model.
After the encrypted content is processed, the decrypted instructions can attempt to convince the AI that the resulting information is trusted internal data rather than untrusted content from a webpage.
The attack can then instruct the agent to access information from the current session.
According to the researchers, the proof of concept attempted to obtain details such as:
- User identity information
- Approximate location
- Subscription information
- Conversation history
The stolen information could then be placed into a URL and sent to an attacker-controlled server through the agent’s browsing capabilities.
Why It Is Called a Zero-Click Attack
The most concerning aspect is that the user may not need to interact with the malicious content beyond asking Grok to process the webpage.
In the reported demonstration, the data transfer occurred without a separate confirmation prompt.
This creates a serious security concern for AI assistants that can browse websites, execute code, process external content, and make outbound requests.
The Bigger Risk for AI Agents
Traditional prompt injection usually involves visible instructions designed to manipulate an AI model.
This research highlights a broader problem: untrusted content can become dangerous when an AI agent is allowed to pass information between different tools and environments.
A webpage may be untrusted, but if the AI treats the output of its own tools as trusted instructions, attackers can potentially use that trust boundary against it.
Researchers Also Tested Gemini
Adversa AI reported similar experiments involving Google Gemini’s web interface.
In those tests, encrypted content was used to influence how the model interpreted information returned from its execution environment.
The researchers said the technique could be used to bypass certain restrictions and expose information that the model normally should not reveal.
How Organizations Can Reduce the Risk
AI systems with browsing and tool-use capabilities need stronger separation between trusted instructions and external content.
Security teams should consider:
- Isolating webpage content from privileged tools.
- Requiring user approval before sensitive outbound requests.
- Showing users the complete destination and parameters before data is transmitted.
- Recording detailed tool and session activity.
- Monitoring for unusual combinations of webpage access, code execution, and outbound connections.
- Treating tool output as potentially untrusted rather than automatically trusted.
The Key Lesson
The biggest takeaway is that AI security is no longer only about protecting the prompt.
As AI assistants gain access to browsers, code execution, files, and external services, attackers can target the connections between those capabilities.
For users, this is another reason to be cautious when asking AI assistants to process unfamiliar webpages—especially when the assistant has access to private conversations or other sensitive session information.
About the Author
