Researchers at Adversa AI discovered a new attack technique and named it Cryptographic Context Injection. They reported their findings to xAI on June 3, 2026, and attempted to coordinate disclosure on August 4 and August 10. At the time of writing, they had received no response.
They could not disclose to Google since jailbreaks are out of scope for its vulnerability disclosure program. Nevertheless, the success rate for the attack against Gemini had fallen by August.
The potential success of this attack by bad actors should be treated seriously. Adversa’s report includes prevention advice for defenders.
Cryptographic context injection
Safety guardrails classify prompt text without executing it. They cannot parse ciphertext into anything harmful and consequently allow its progress. The ciphertext, including an instruction and means for decryption, are run inside the model’s code execution sandbox. The result is the plaintext prompt is recovered inside the trusted execution context and not flagged by the guardrails as harmful.
“The attacker payload inherits a credibility that the same text would never get if pasted directly into the prompt,” warn the researchers.
The encrypted attack can be delivered directly to the Chat or indirectly as a watering hole attack. In the latter case, an encrypted JSON object and decryption could be included in a web page. An agent subsequently instructed to act on this page (perhaps to summarize the content or extract specific data) will ingest the ciphertext and kick off the attack.
The decrypted prompt could instruct the model, “to reach out to external servers, leaking the user’s data through request parameters, or produce some other undesired output and re-encrypt it to smuggle it past output guardrails.” In an agentic scenario the instructions could instigate misuse of any tool available to the model.