AI Governance Institute
← News
Research2026-08-21

Encrypted Prompts Defeat AI Guardrails in Grok and Gemini

What happened

Adversa AI published research, reported by SecurityWeek in Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini, documenting a novel attack technique called Cryptographic Context Injection that successfully circumvented the built-in safety guardrails of xAI's Grok and Google's Gemini. The attack works by encoding malicious instructions as ciphertext within a prompt: safety filters classify the text as benign because the instructions are not human-readable at the point of inspection, and the ciphertext then decrypts inside a trusted execution context where it is acted upon by the model. The technique has direct implications for enterprises that have deployed these models in agentic workflows, where an injected payload could trigger unauthorized actions without triggering content moderation. This finding is consistent with a growing body of research on prompt injection and guardrail evasion, including a commercially sold bypass reported earlier this year and findings from the OWASP Top 10 for Large Language Model Applications threat catalog. The OWASP Top 10 for Large Language Model Applications specifically identifies prompt injection as a top-tier risk, and this research demonstrates that the attack surface now extends to cryptographic obfuscation of malicious payloads.

Why it matters

  • ·Vendor-side content filters cannot be assumed to catch obfuscated inputs, which means any compliance program that treats platform guardrails as a sufficient control for input validation or data loss prevention now has a documented gap. Enterprises must layer their own input inspection and output monitoring on top of model-native safety systems.
  • ·Agentic workflows face elevated risk because a successful Cryptographic Context Injection attack can cause an agent to execute unauthorized instructions autonomously, bypassing the human oversight gates that governance programs typically rely on. As agentic AI drives a surge in disclosed vulnerabilities, this technique adds a cryptographic dimension that existing adversarial testing programs may not yet cover.
  • ·Red-teaming and adversarial testing programs that focus on plaintext jailbreak attempts and standard prompt injection patterns will not detect this class of attack without specific test cases for ciphertext-encoded payloads. Organizations subject to ISO/IEC 42001:2023 or other governance frameworks requiring documented adversarial testing must update their test scope to reflect cryptographic obfuscation vectors.

Governance controls affected

SEC-001Prompt Injection PreventionAGT-002Agent Prompt Injection DefenseSAF-006Post-Deployment Adversarial Testing CadenceAGT-011Agent Behavior Monitoring and Anomaly DetectionSEC-005Adversarial Robustness Testing

What to do now

  • ☐Review your adversarial testing program to confirm it includes ciphertext-encoded and obfuscated prompt injection test cases, not only plaintext jailbreak attempts.
  • ☐Audit agentic deployments using Grok or Gemini to determine whether any workflow accepts user-supplied or third-party-supplied prompt content that could carry encoded payloads.
  • ☐Update your output guardrail and content filtering controls to include post-decryption or post-execution output monitoring, not only pre-execution input classification.
  • ☐Escalate this research to your vendor management team and request written confirmation from xAI and Google DeepMind on whether patches or mitigations have been applied and on what timeline.
  • ☐Classify Cryptographic Context Injection as a named threat in your AI risk register and assign it a severity rating consistent with your incident response severity classification criteria.

What to watch next

Compliance teams should monitor whether xAI and Google DeepMind issue formal security advisories or patch timelines in response to this research, as the absence of a public response would itself be a vendor governance signal worth escalating. The White House AI Vulnerability-Sharing Initiative remains operationally undefined, and this finding illustrates why a coordinated disclosure and remediation workflow between frontier labs and enterprise deployers is urgently needed. As adversarial research continues to demonstrate that safety filters can be circumvented through obfuscation rather than direct instruction, regulatory guidance on minimum input-side security standards for high-risk AI deployments is likely to accelerate.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Powered by Buttondown.

Related Coverage

Research2026-08-25

InjecMEM Plants Persistent Agent Instructions via Single Prompt, 76.6% Success Rate

Researchers from Shanghai Jiao Tong University and Ant Group have demonstrated InjecMEM, an attack technique that injects malicious instructions into AI agent memory systems through a single ordinary interaction, without requiring direct access to the memory store. The attack persists across sessions, achieving a 76.6% success rate against the MemoryOS system. Experts warn that inference-time input and output filtering, the most common enterprise defense, does not stop this class of attack.

Research2026-09-02

Cyble's 2026 Report Codifies Untrusted-Input and Least-Privilege as Baseline Agent Controls

Cyble's AI Threat Landscape Report 2026 catalogues the attack surfaces surrounding agentic AI deployments, including prompt injection, RAG poisoning, vector store manipulation, and API credential theft. The report recommends that enterprises treat all content ingested by AI systems as untrusted, enforce least-privilege boundaries for every agent, and conduct adversarial red teaming as a standard operational control. Its findings represent a threat-intelligence codification of risks that regulators and auditors are increasingly treating as the baseline for reasonable AI security.

Research2026-09-04

ASCII Smuggling Bridges Email Phishing and AI Prompt Injection at Scale

Microsoft researchers documented a phishing campaign exceeding 2.37 million messages that repurposed ASCII smuggling, a technique originally associated with AI prompt injection, to evade email content filters using invisible Unicode characters. The campaign targeted financial keywords and ran from late February through mid-June 2026 across roughly 150 disposable domains. Microsoft's recommended defense, stripping invisible Unicode before content evaluation, applies equally to email filters and AI assistant input pipelines.