The Filter Can't Decrypt. The Model Can. That Asymmetry Is the Whole Bug — and It Has Been Open at xAI Since June 3.
- Patrick Duggan
- 27 minutes ago
- 5 min read
Researchers at Adversa have shown that xAI's Grok web chat agent can be made to follow instructions planted on a web page, and to send user chat data to a server the attacker controls. The delivery method is the interesting part, and it generalises well past Grok, which is why we are writing about it rather than about xAI.
The attacker puts an encrypted blob on the page. Alongside it, the key material. Alongside that, a polite instruction to decrypt the blob and do what it says.
The input filter looks at the page and sees ciphertext. Ciphertext is not a jailbreak, contains no forbidden strings, and matches no pattern the classifier was trained on, so it passes. The model then reads the same page, runs the key derivation and the decryption — the researchers used PBKDF2 followed by AES-256-GCM — recovers the plaintext instructions, and carries them out.
Nothing was smuggled past the filter. The filter looked directly at the payload and was structurally incapable of reading it.
The Asymmetry Is the Bug
Strip away the cryptography and what remains is a claim about architecture: the guardrail is less capable than the thing it guards.
A content classifier inspects. It matches patterns, scores toxicity, flags known shapes. It does not execute. It does not run a key-derivation function on an attacker-supplied salt because nobody would build an inspection layer that performs arbitrary computation on hostile input — that would be its own catastrophe.
The model does execute, in the only sense that matters here. Give it a key and a ciphertext and a reason, and it will do the arithmetic, because doing the arithmetic is what it is for.
So the defender's inspection layer is, by design, strictly weaker at interpretation than the layer it is protecting. Any transform the model can invert and the scanner will not perform is a channel. Encryption is one. It is not the only one, it is not the last one, and the researchers picked it because it is the most legible demonstration — not because it is the only key that fits.
We Wrote the Class in March. Somebody Else Found the Sharpest Instance.
In March we covered LayerX's research on font-based attacks against AI assistants — modify a TrueType font's character-to-glyph mapping so the human sees one string and the model reads another. The credit for that work is LayerX's; the credit for this work is Adversa's. We are claiming neither.
What we will claim is the framing, because we have been consistent about it since March: in every one of these attacks, what the checking layer perceives is not what the executing layer perceives. March's version exploited a rendering gap — the difference between glyph and codepoint. This one exploits a computation gap, and the computation gap is the more serious of the two, because a rendering gap is bounded by what a renderer does and a computation gap is bounded only by what a language model can be talked into calculating. That set grows every time the models get better.
Which is an uncomfortable property for a defence to have. Guardrail-by-classifier gets weaker, relative to the thing it guards, with every capability release. It is the only security control we can think of that is actively degraded by its own vendor's roadmap.
The Disclosure Timeline
Adversa notified xAI on June 3, 2026, directly and through the company's HackerOne programme. xAI acknowledged the report and gave no mitigation timeline. The researchers raised it again on August 4, and again on August 10. As of August 19 it remained unpatched.
That is seventy-seven days on a working data-exfiltration path against a consumer product, with the reporter following up twice into a timeline-free acknowledgement.
We cover vendors straight here, including ones we have no relationship with and including ones we do. So: the reporting behaviour is the part that deserves criticism, not the existence of the bug. Indirect prompt injection is an unsolved problem across the entire industry and no vendor has a clean answer to it. Having the bug is not the failure. Sitting on a live exfiltration path for eleven weeks without giving the reporter a date is.
What Holds, and What We Are Not Claiming
Our standing beat here is which agent resisted, reported flat in both directions. So, flatly: this specific technique was demonstrated against Grok's web chat agent. We have not run it against other assistants, and we are not going to imply results we do not have. Any vendor claiming immunity to this class should be asked to show the test, not the assertion.
What we can say from the architecture alone is which products are in scope for the class. If your product puts a classifier in front of a model, and the model can browse or read attacker-influenceable content, and the model is capable of general computation on what it reads — that is every mainstream assistant with web access — then the gap exists in your stack too. Whether anyone has bothered to build the payload for you is a separate question, and a less comforting one than it sounds.
What Actually Helps
Not a better classifier. That is the trap this bug exists to illustrate: a stronger pattern-matcher does not close a gap that is definitionally about the difference between matching and computing.
What helps is moving the control off the input path and onto the action path. Do not try to decide whether a page is safe to read. Decide what the agent is permitted to do after reading it, and enforce that where the action happens rather than where the text arrives. Egress restrictions on where an agent may send data. Explicit human confirmation for exfiltration-shaped actions regardless of how reasonable the request looked. Separate trust levels for content the user typed versus content the agent fetched, maintained all the way through the context rather than flattened into one undifferentiated prompt.
None of that is novel and none of it is easy. But it has the property the classifier lacks: it does not depend on the defender out-reading the model, which is a race the defender is structurally set up to lose.
Was this useful, or did we miss something? Rate this post below — we read every one, and the low scores are the ones that change what we build.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=the-filter-can-t-decrypt-the-model-can-that-asymmetry-is-the-whole-bug-and-it-has-been-open-at-x
Comments