AI Assistants Fall Prey to New Type of Attack
A new threat has been discovered that tricks AI assistants into executing malicious instructions. This technique, called Cryptographic Context Injection, hides malicious code inside encrypted data and deceives the AI into decrypting it using its own tools.
Researchers behind this breakthrough describe prompt injection attacks as a persistent problem that may never be fully resolved. These types of attacks work by inserting fake commands into documents or webpages an AI assistant reads, leading to disastrous consequences for user security and data integrity.
To mitigate the risk of these attacks, AI providers have implemented guardrails – safeguards designed to prevent their systems from intentionally or unintentionally doing things they shouldn’t do. However, researchers found that malicious code can evade some AI guardrails by being encrypted.
The encrypted instructions are then decrypted using the AI’s own coding tools, allowing them to bypass initial security checks and masquerade as legitimate commands. This is similar to hiding malware in a language the security system cannot understand – once translated, the AI follows the instructions without hesitation.
Researchers tested their method against two popular AI agents: Grok and Gemini. In both cases, they successfully executed malicious instructions using this new technique. The attack on Grok allowed them to steal sensitive information from users, including names, locations, subscription tiers, and conversation histories. Meanwhile, the attack on Gemini bypassed safety controls and generated content that would normally be blocked by the AI.
Due to concerns about xAI’s response time after being notified of a flaw in Grok back in June 2026, researchers did not provide full details of their findings. However, they noted that Gemini has made some improvements but still hasn’t fully addressed this vulnerability.
To stay safe when using AI assistants, it is essential to exercise caution and not automatically trust these tools with sensitive data or powerful functions. Here are some best practices to follow:
When interacting with unfamiliar webpages, documents, or shared links through an AI assistant, treat the summaries provided with skepticism – especially if the tool can browse or run code. Do not paste passwords, recovery codes, API keys, financial information, or sensitive health and work details into AI chats unless you understand how that data will be handled.
Regularly review your AI assistant’s connected tools and permissions to ensure it doesn’t have access to unnecessary features like email, cloud storage, source-code repositories, or external integrations. Be cautious if an AI tool asks to decrypt, decode, run a script, open a new link, or upload data as part of what seems like an ordinary task.
Finally, keep your browser and AI applications updated, check vendor security advisories when using features such as browsing, autonomous agents, or code execution, and use up-to-date anti-malware solutions to detect and block malicious downloads and suspicious connections. If something feels off, verify it before proceeding.