🍭 Grok Decrypts Its Own Attack 🔓

Good morning.

"The scanner didn't flag anything." Correct. That was the whole plan.

Let’s dive in 👇

🍳 What’s Cookin’:

• Grok will decrypt a stranger's instructions and then follow them

• A robot ran the 100m faster than Usain Bolt, then hit a wall

• Nvidia paid Poolside $6B for a license, not a company (wink)

• Alibaba is raising $10.2B and spending all of it on AI

Grok
🔎 Runs The Attacker's Code For Him

The Bite:

Security firm Adversa AI disclosed a prompt injection technique against xAI's Grok web chat on August 20.

The method, which Adversa calls Cryptographic Context Injection, places instructions on a web page as encrypted text, alongside the key needed to unlock it.

Grok's input filter cannot read the encrypted block and passes it to the model.

The model then decrypts the payload inside its own code-execution sandbox and treats the recovered text as instructions.

In Adversa's demonstration, asking Grok to summarize the page sent the user's name, coarse location, subscription tier, and full conversation to an attacker-controlled URL.

Adversa reported the issue to xAI on June 3 and says it still worked on August 19.

Snacks:

• The payload uses AES-256-GCM, so recovering the text means actually running the decryption, not pattern matching it.

• Weaker encodings like base64 fail here because models decode them natively, letting guardrails catch the instructions.

• Adversa disclosed the issue to xAI directly and through HackerOne on June 3, then followed up on August 4 and August 10.

• xAI acknowledged the report but gave no mitigation timeline, and no CVE has been issued.

• The stolen data is sent as parameters appended to a URL, with no confirmation step and no visible warning.

• The same technique on Google's Gemini produced instructions for building an incendiary weapon.

Why it Bites:

The guardrail and the runtime are looking at two different things.

The filter reads a string. The sandbox executes a program.

Everything on that page is harmless in isolation: a key, a block of noise, and a polite request to decrypt it.

No content classifier does cryptography at inspection time, so it just passes.

The model assembles the weapon itself.

That is the uncomfortable part. The attacker shipped the parts, but Grok did the assembly, then simply trusted its own output.

Encryption is just today's version of the trick. Utevsky points out the fragments could be split across several pages and tool calls, none meaningful alone.

Nothing stops it either.

Eleven weeks, three notifications, no patch, no CVE.

The box is locked. The key is taped to the lid.
And the model has been trained to be helpful.

Steal This Prompt
🧱 Turn Anything Into A LEGO Minifigure

Ever wondered what your boss, startup, dog, or favorite movie character would look like as a collectible LEGO minifig?

Use it to:

• Turn yourself into a LEGO collectible

• Create LEGO versions of your brand mascots

• Rebuild famous characters as minifigures

Workflow:

1. Hit this link: LEGO Minifigures

2. Paste into your AI model

3. Replace the #s with your character, person, or idea

4. Watch it cook into a minifigure you'd absolutely overpay for on eBay

   Try the prompt on Snack Prompt

_ToolBox™
🧰 5 BRAND NEW AI LAUNCHES

🕹️ Decawork

Your team already built AI agents on Claude Code and Codex, and IT has no idea they exist; this puts them on company accounts and gives them access, oversight, and a retirement date.

📊 Navigara

Reads your Git history and Jira board to tell you what each roadmap item actually cost in AI tokens, and which spend went nowhere.

🔀 Offloop

A workspace where handoffs between humans and agents survive the handoff, instead of every stage starting over in a fresh chat window.

📱 Antigravity Remote Control

Approve commands and review agent plans from your phone while the credentials, context, and build tools stay on the workstation at home.

🧠 Dropstone

Model-agnostic runtime that checks its own work and carries what it learned from your codebase into your spreadsheets, instead of forgetting it at the session boundary.

_{Everything Else}
🧠 You Need to Know

🦾 Humanoid Robot Beats Usain Bolt's 100m Record
→ A Beijing-based X-Humanoid machine ran 100 meters in 9.39 seconds at Saturday's World Humanoid Robot Games, faster than Bolt's 9.58-second mark from 2009.

💰 Alibaba Raises $10.2B In Record Hong Kong Placement
→ Alibaba is selling 710 million shares at HK$112.70 and directing 100% of net proceeds to full-stack AI capabilities including chips and infrastructure.

🧠 DeepSeek Ships An Experimental Vision Model
→ V4-Flash-Vision-Exp went live on the API platform, adding image understanding to V4-Flash and beating Claude Opus 4.8 on three of eleven published benchmarks.

🚨 Grok Leaks User Chats Through Encrypted Web Pages
→ Adversa AI showed that an AES-encrypted payload on a page survives Grok's input filter, decrypts inside its own sandbox, and sends names, locations, and full conversations to an attacker.

🤝 Nvidia Pays Poolside $6B For Its Model Factory
→ The non-exclusive license covers the software behind Poolside's Laguna coding models, alongside a $1 billion investment at a $12 billion pre-money valuation and job offers to 109 employees.