Encryption is supposed to be the thing that keeps attackers out. Adversa AI just showed a case where it's the thing that gets malicious instructions in — past every text-based guardrail Grok and Gemini had, with zero clicks from the victim. Let's break down why this worked and where in a request pipeline it should have died.
What happened
Adversa AI researchers built a webpage containing an AES-encrypted blob. Nothing unusual about the page itself if you're scanning for prompt injection with regex or keyword matching — the malicious instructions are ciphertext. There's no "ignore previous instructions" string to catch, no suspicious plaintext at all.
The trick: Grok (and separately, Gemini) has code execution capability. When the model encounters the page and runs the decryption routine in its own sandbox, it decrypts the blob itself. The plaintext that comes out the other end isn't treated as "content I just fetched from an untrusted webpage." It's treated as the model's own generated output — trusted context, the same category as its own reasoning.
That plaintext contained instructions to make an outbound URL request, exfiltrating the user's chat history, name, and location to an attacker-controlled endpoint. Zero clicks. The user never approved anything, because from the model's perspective, nothing external ever "entered" — it just ran its own decryption code and acted on the result. For Gemini, the same technique was used to bypass safety filters entirely, since the harmful content was never visible in plaintext to the filter layer.
