Researchers at Adversa AI discovered a new attack technique and named it Cryptographic Context Injection. They reported their findings to xAI on June 3, 2026, and attempted to coordinate disclosure on August 4 and August 10. At the time of writing, they had received no response.
They could not disclose to Google since jailbreaks are out of scope for its vulnerability disclosure program. Nevertheless, the success rate for the attack against Gemini had fallen by August.
The potential success of this attack by bad actors should be treated seriously. Adversa’s report includes prevention advice for defenders.
Cryptographic context injection
Safety guardrails classify prompt text without executing it. They cannot parse ciphertext into anything harmful and consequently allow its progress. The ciphertext, including an instruction and means for decryption, are run inside the model’s code execution sandbox. The result is the plaintext prompt is recovered inside the trusted execution context and not flagged by the guardrails as harmful.
