Encrypted Prompts Defeat AI Guardrails in Grok and Gemini
What happened
Adversa AI published research, reported by SecurityWeek in Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini, documenting a novel attack technique called Cryptographic Context Injection that successfully circumvented the built-in safety guardrails of xAI's Grok and Google's Gemini. The attack works by encoding malicious instructions as ciphertext within a prompt: safety filters classify the text as benign because the instructions are not human-readable at the point of inspection, and the ciphertext then decrypts inside a trusted execution context where it is acted upon by the model. The technique has direct implications for enterprises that have deployed these models in agentic workflows, where an injected payload could trigger unauthorized actions without triggering content moderation. This finding is consistent with a growing body of research on prompt injection and guardrail evasion, including a commercially sold bypass reported earlier this year and findings from the OWASP Top 10 for Large Language Model Applications threat catalog. The OWASP Top 10 for Large Language Model Applications specifically identifies prompt injection as a top-tier risk, and this research demonstrates that the attack surface now extends to cryptographic obfuscation of malicious payloads.
Why it matters
- ·Vendor-side content filters cannot be assumed to catch obfuscated inputs, which means any compliance program that treats platform guardrails as a sufficient control for input validation or data loss prevention now has a documented gap. Enterprises must layer their own input inspection and output monitoring on top of model-native safety systems.
- ·Agentic workflows face elevated risk because a successful Cryptographic Context Injection attack can cause an agent to execute unauthorized instructions autonomously, bypassing the human oversight gates that governance programs typically rely on. As agentic AI drives a surge in disclosed vulnerabilities, this technique adds a cryptographic dimension that existing adversarial testing programs may not yet cover.
- ·Red-teaming and adversarial testing programs that focus on plaintext jailbreak attempts and standard prompt injection patterns will not detect this class of attack without specific test cases for ciphertext-encoded payloads. Organizations subject to ISO/IEC 42001:2023 or other governance frameworks requiring documented adversarial testing must update their test scope to reflect cryptographic obfuscation vectors.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Review your adversarial testing program to confirm it includes ciphertext-encoded and obfuscated prompt injection test cases, not only plaintext jailbreak attempts.
- ☐Audit agentic deployments using Grok or Gemini to determine whether any workflow accepts user-supplied or third-party-supplied prompt content that could carry encoded payloads.
- ☐Update your output guardrail and content filtering controls to include post-decryption or post-execution output monitoring, not only pre-execution input classification.
- ☐Escalate this research to your vendor management team and request written confirmation from xAI and Google DeepMind on whether patches or mitigations have been applied and on what timeline.
- ☐Classify Cryptographic Context Injection as a named threat in your AI risk register and assign it a severity rating consistent with your incident response severity classification criteria.
What to watch next
Compliance teams should monitor whether xAI and Google DeepMind issue formal security advisories or patch timelines in response to this research, as the absence of a public response would itself be a vendor governance signal worth escalating. The White House AI Vulnerability-Sharing Initiative remains operationally undefined, and this finding illustrates why a coordinated disclosure and remediation workflow between frontier labs and enterprise deployers is urgently needed. As adversarial research continues to demonstrate that safety filters can be circumvented through obfuscation rather than direct instruction, regulatory guidance on minimum input-side security standards for high-risk AI deployments is likely to accelerate.