Prompt injection · Gemini · Google · Microsoft · Copilot · Ars Technica
Once Grok opens the link, the data is in the logs of the attacker’s server
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
◌ Single Source
Adversa can’t be sure what causes Grok to refuse precisely the same plaintext instructions and follow the encrypted ones.
Key facts
- Instructions to process the ciphertext with PBKDF2 and AES-256-GCM pass the filter as an ordinary request, because a classifier can read them but not resolve what they unlock
- Everything a guardrail’s scanner would need is right there on the page, but recovering the plaintext means running PBKDF2 and AES-256-GCM, which no content classifier does at inspection time
- Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s
- The Cryptographic Context Injection is only the latest example of the disadvantage LLM defenders operate
Summary
Earlier this week, researchers outlined an attack that used a secret input provided by Microsoft 365 Copilot for enterprise to cause the AI assistant to exfiltrate a password present in the user’s inbox. The lesson from both this week’s episodes—and the countless other ones that have come before it—is that LLMs are incapable of solving the root causes for prompt injections, the most severe vulnerability classes they’re most prone to. Prompt injections exploit LLMs’ training to comply with user requests whenever possible. Rony Utevsky, a researcher at security firm Adversa, recently discovered a simple way to completely bypass that restriction. Rather than composing the harmful instruction in plaintext, the hacker encrypts it. The deciphered instructions direct the LLM to construct what is purported to be a decryption key. Once Grok opens the link, the data is in the logs of the attacker’s server.