Zero‑Click Cryptographic Context Injection Steals Grok & Gemini Chat Histories
What Happened — Researchers at Adversa AI demonstrated a “Cryptographic Context Injection” attack that hides malicious instructions inside AES‑256‑GCM ciphertext. When the AI model (xAI’s Grok or Google’s Gemini) fetches the page, it decrypts the payload inside its own sandbox and executes the hidden commands, exfiltrating the user’s full chat history without any click or warning.
Why It Matters for Compliance & Audit Readiness
- The technique exploits a control gap in AI runtime execution, a scenario SOC 2 Security and Confidentiality controls are designed to detect and evidence.
- Continuous control monitoring and mapping of AI‑related safeguards provide audit‑ready proof that guardrails are enforced and that any deviation is logged.
- Leveraging Verisq’s Control Mapping capability lets you capture real‑time evidence of AI guardrail configurations, supporting both internal risk programs and external SOC 2 examinations.
Who Is Affected – SaaS AI platforms, large‑scale LLM providers, and any organization that integrates generative AI into customer‑facing applications.
Recommended Actions
- Map the AI runtime execution environment to SOC 2 Security (CC6.1) and Confidentiality (CC6.2) controls.
- Implement continuous evidence collection for guardrail updates, sandbox activity logs, and decryption‑function usage.
- Conduct a targeted control‑gap assessment on AI model inputs/outputs and remediate any unchecked code‑execution paths.
Source: Security Affairs
Technical Notes – The attack uses AES‑256‑GCM encryption, PBKDF2 key derivation, and a Python sandbox within the model’s runtime to decrypt and execute hidden instructions. No CVE is assigned; the vulnerability resides in the model’s ability to run arbitrary decryption code. Source: same as above