Grok漏洞評測：加密提示詞注入零點擊偷走對話 | Grok Vulnerability Review: Zero-Click Prompt Injection

By Kit 小克 | AI Tool Observer | 2026-08-30

🇹🇼 Grok漏洞評測：加密提示詞注入零點擊偷走對話

Grok聊天機器人被資安研究團隊Adversa AI踢爆一個名為Cryptographic Context Injection（加密提示詞注入）的漏洞：使用者只要請Grok「幫我摘要這個網頁」，姓名、大概位置、訂閱等級跟完整對話紀錄，就可能在完全沒被察覺的情況下傳到駭客的伺服器。這個漏洞從6月通報至今，xAI都還沒修好。

Cryptographic Context Injection是怎麼運作的？

傳統的提示詞注入（prompt injection）靠的是在網頁裡藏一段明文指令，指望AI讀到後乖乖照做——這種攻擊比較容易被內容過濾器抓到，因為文字掃得到。Adversa AI這次的手法聰明在哪？他們把惡意指令用AES-256加密包起來藏在網頁裡：

攻擊者在網頁上放一段加密過的JSON payload，外加「解密方法」的說明
使用者請Grok摘要這個網頁，Grok的Python執行環境照著說明把密文解開
解密出來的指令，Grok會當成「自己執行程式碼跑出來的結果」，而不是「外部網頁塞給我的內容」——防護機制的信任邊界就這樣被繞過
指令要Grok把使用者的姓名、位置、訂閱方案、對話內容塞進一個網址，再用瀏覽工具打開這個網址
資料就這樣透過網址參數，傳到攻擊者控制的伺服器

整個過程沒有任何確認彈窗，使用者也看不到警告。研究團隊8月19日對Grok 4.5 Fast測試，20次攻擊裡成功8次，成功率約40%，失敗多是Grok自己解密失敗，而不是被防護機制擋下來。

為什麼內容審查攔不住？

核心問題在於：密文本身是亂碼，內容分類器（content classifier）沒辦法在執行前判斷這段文字是不是惡意指令。等到Grok自己把它解密出來，那些指令已經被當成「內部產出」而非「外部輸入」，等於直接跳過了原本該做的可信度檢查。

修補進度：目前還沒有

Adversa AI在6月3日就透過HackerOne通報xAI，8月4日、10日又追問了兩次，xAI雖然回覆「已收到報告」，但沒給出具體修補時間表。截至8月19日，這個漏洞在Grok網頁版依然可以重現，也還沒有CVE編號。

一般使用者該怎麼辦

目前沒有使用者端能自己做的防護，這是產品端的架構問題
如果工作上需要用Grok處理不信任的網頁或文件，先假設任何「摘要」動作都可能觸發你看不到的外部連線
敏感資訊（帳號、地點）盡量避免混在同一個對話串裡叫Grok去讀外部連結
持續關注xAI是否釋出修補，這類漏洞一旦有人開始惡意利用，很難即時察覺

這不是Grok第一次、也不會是最後一次踩到「AI工具信任了不該信任的內容」這個坑，Anthropic、OpenAI的agent工具過去也都出過類似問題。差別在於這次繞過防護的手法比較刁鑽，也比較有代表性——未來看到「加密」兩個字，不代表這段內容就是安全的。

好不好用，試了才知道

🇺🇸 Grok Vulnerability Review: Zero-Click Prompt Injection

Grok, xAI's chatbot, has a vulnerability security researchers at Adversa AI are calling Cryptographic Context Injection: just ask Grok to summarize a webpage, and your name, approximate location, subscription tier, and full conversation history can leak to an attacker's server without any warning. It was reported to xAI in June, and as of this writing, still isn't fixed.

How Cryptographic Context Injection Works

Classic prompt injection hides plain-text instructions on a page and hopes the AI follows them — easy for a content classifier to catch, since the text is readable. Adversa's trick is different: they wrap the malicious payload in AES-256 encryption before hiding it on the page.

An attacker embeds an encrypted JSON payload on a webpage, along with instructions for "decrypting" it
The user asks Grok to summarize the page; Grok's Python runtime dutifully decrypts the ciphertext
Grok treats the decrypted instructions as its own code output, not as untrusted external content — the trust boundary that's supposed to stop this quietly disappears
The instructions tell Grok to stuff the user's name, location, subscription tier, and chat prompts into a URL
Grok's browsing tool opens that URL, shipping the data straight to the attacker's server via query parameters

No confirmation dialog, no visible warning. Researchers reproduced the attack against Grok 4.5 Fast on August 19; 8 of 20 attempts succeeded — about a 40% hit rate, with most failures coming from Grok's own decryption errors rather than any guardrail catching it.

Why Filters Can't Catch It

The core issue: ciphertext looks like noise to a content classifier — there's nothing to flag before execution. By the time Grok decrypts it, the instructions get treated as internal output instead of external input, skipping the trust checks that would normally apply.

Patch Status: Still None

Adversa AI reported the bug to xAI via HackerOne on June 3, followed up on August 4 and 10. xAI acknowledged the report but gave no specifics and no mitigation timeline. As of August 19, the attack still reproduces on Grok's web chat, and no CVE has been assigned.

What You Can Actually Do

There's no user-side fix — this is an architecture problem on xAI's end
If you use Grok to process untrusted pages or documents at work, assume any "summarize this" request could trigger an outbound connection you don't see
Keep sensitive info (account details, location) out of the same thread where you're asking Grok to read external links
Watch for an xAI patch — bugs like this are hard to detect once someone starts exploiting them quietly

This isn't the first time an AI agent has trusted content it shouldn't have, and it won't be the last — Anthropic and OpenAI's agent tools have hit similar issues before. What's notable here is how the encryption trick slips past filters: seeing "encrypted" doesn't mean a payload is safe.

好不好用，試了才知道

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士