Adversa AI's encrypted prompt injection slips past Grok and Gemini guardrails

What the researchers did

Security researchers at Adversa AI demonstrated a prompt-injection attack that hides its payload inside AES-encrypted text, according to a technical write-up published on dev.to. The researchers built a webpage carrying an encrypted blob of instructions. To any filter that hunts for injection by pattern-matching text, the page looks inert: the malicious content is ciphertext, so there is no telltale instruction phrasing for keyword or regex checks to catch.

The targets were xAI's Grok and, in a separate variant, Google's Gemini. Both models can execute code. When an agent encounters the page during ordinary browsing, the model runs the decryption routine itself, inside its own sandbox, using a key or method embedded in or alongside the ciphertext. The plaintext that emerges is then treated as though the model had generated it, rather than as untrusted content fetched from the web.

That plaintext directed the model to issue an outbound URL request carrying the user's chat history, name and location to a server controlled by the attacker. The dev.to post describes the attack as zero-click: the user approved nothing, because from the model's point of view no external input ever arrived — it simply ran its own decryption code and followed the result. In the Gemini variant, the same technique reportedly bypassed safety filters entirely, since the harmful content was never visible in plaintext to the filtering layer.

A provenance failure at the code-execution boundary

The write-up frames the issue as a lost-provenance problem rather than a cryptography problem. Every step in the chain looks legitimate in isolation. Decrypting data is a normal operation. Fetching a URL is a normal tool call. The failure occurs the moment code execution finishes: the decrypted output re-enters the context window with no marker recording that it originated from untrusted external ciphertext a few steps earlier. The model, inclined to trust its own output, then carries out whatever the plaintext asks for.

Why existing guardrails saw nothing

Conventional LLM guardrails sit at two points: input text before it reaches the model, and the final response before it reaches the user. Neither vantage point observes this attack. Input-side scanners see only ciphertext, with no strings to match. Output-side scanners review the model's reply to the user, not the intermediate tool calls or the arguments of a URL request made mid-conversation. Classifiers trained on plaintext injection patterns are useless against a payload that stays opaque until it is decrypted inside a sandbox they cannot inspect.

Where detection would have to happen

The post — which also promotes a firewall product named Sentinel — argues that trying to predict what ciphertext contains is a losing game, and that the attack becomes observable only at two points: tool results returning into the model's context, and outbound tool calls. Decrypted plaintext surfacing as a code-execution result can be scanned like any other tool output, and an outbound request carrying a user's chat history and location has exfiltration characteristics regardless of how the instruction arrived. The broader argument is that encoding tricks defeat text-matching input filters, but not a proxy positioned on the tool-result and tool-call path.

Two caveats deserve mention. The claims arrive through a single secondary write-up rather than the original Adversa AI report, and the blocking examples included in the post are explicitly illustrative rather than artifacts captured during the research.

Why it matters

As chatbots gain code execution and web access, the assumption that anything the model itself produced is trustworthy stops holding. Encrypted text is only one transformation; base64, hex and similar encodings work on the same principle, and any agent that can both fetch web content and run code is exposed to the resulting chain. The attack also removes the victim from the loop entirely — earlier prompt-injection techniques generally needed someone to click a link or paste text, while this one requires no interaction at all. The practical consequence for defenders is that guardrails designed for text-in, text-out pipelines do not map onto agentic systems. Provenance tracking across code-execution boundaries and scrutiny of outbound tool calls become the controls that can actually see this class of attack.