New Encrypted Prompt Injection Attack Bypasses AI Guardrails

A New Twist on an Old Vulnerability

Security researchers have disclosed a novel technique that lets attackers slip malicious instructions past the safety filters built into large language models by disguising those instructions as encrypted or obfuscated text. Dubbed "cryptographic context injection," the method was developed by Rony Utevsky, a researcher at the AI security firm Adversa, and exploits how models process and interpret context rather than any single coding bug 1. Instead of feeding an AI system a plainly readable malicious command — which modern guardrails are increasingly good at catching — the attack encodes the payload in a way that the model still decodes and acts upon, even though automated content filters fail to recognize it as harmful 1.

Adversa demonstrated the technique against Grok, showing that a webpage embedding an encrypted instruction could trick the chatbot into quietly transmitting a user's name, location, account tier, and prior chat prompts to a server controlled by the attacker 3. Because the exfiltration happens through the AI's own trusted execution path, it can occur without any obvious sign to the victim, raising concerns about how easily conversational AI tools can be turned into covert data leaks simply by having a user visit or interact with a compromised page.

A Widening Pattern of Prompt Injection Abuse

The Grok case is not an isolated example. Researchers separately identified a one-click flaw in Atlassian's Rovo assistant in which a specially crafted link could inject hidden instructions into the tool, exploiting its broad enterprise permissions and autonomous agent capabilities to potentially exfiltrate sensitive corporate data 2. Together, these disclosures underscore a recurring theme: as AI agents are granted deeper access to enterprise systems, files, and user data, the potential blast radius of a successful prompt injection grows substantially.

The underlying vulnerability is also proving to be strikingly low-tech in some cases. In a real-world legal filing, a self-represented plaintiff in a Connecticut court attempted to manipulate an AI-assisted review process by hiding a prompt injection instruction inside a court document, apparently hoping to sway an automated or AI-augmented judicial decision in their favor; the attempt was discovered, and the court barred the plaintiff from submitting further filings 5. Commentators have noted the parallel to decades-old search engine manipulation tactics, such as hiding white text on white backgrounds to game search rankings, suggesting prompt injection is simply the latest evolution of an old trick — burying instructions where only a machine, not a human reader, will notice them 4.

Why It Matters

Taken together, these incidents show that prompt injection is no longer a theoretical curiosity but a practical attack surface spanning consumer chatbots, enterprise AI agents, and even legal proceedings. As organizations deploy AI systems with real permissions and real consequences, the industry faces mounting pressure to develop guardrails that scrutinize not just what text says, but what a model ultimately does with it.