Encrypted-prompt injection breaks AI safety guardrails and OWASP rewrites its top‑risk list

Encrypted prompt payloads detonate inside trusted AI runtimes

Security researchers on August 23, 2026 published a technique they call Cryptographic Context Injection. The attack wraps malicious instructions in an encrypted blob, delivers that blob through a passive webpage or document, and only decrypts the payload once the AI assistant — or an LLM agent browsing on its behalf — pulls the content into a trusted execution context. The reports describe the decrypted payload then steering chat data, including conversation history, toward exfiltration paths.

The behavior is confirmed across both Grok and Gemini assistants. Independent write‑ups describe a "zero‑click" path against Grok: a user simply visits a webpage, the embedded encrypted blob is consumed by the assistant, and chat data is silently exfiltrated without further user interaction. One vendor write‑up frames the chain as "decrypted an attacker's payload mid‑execution, then exfiltrated your chat history."

The OWASP Top 10 has been republished for 2026

The same day, OWASP released the eighth edition of its Top 10 security risks list for 2026, with two newly added risk categories and what one outlet characterizes as significant restructuring of the existing categories. Security teams that have already mapped controls to the previous Top 10 should expect reassessing the list to be a near‑term deliverable, because policy mappings, audit checklists and developer training material all read off that document.

Why the cryptographic wrapping is the threat to track

Treating the encrypted blob as opaque content is exactly what makes the technique succeed: scanners that look for known jailbreak strings see ciphertext, and the dangerous text only exists in clear form after the trusted runtime hands it a decryption key. That shift moves the trust boundary from "what did the user paste into the prompt?" to "what did the assistant decrypt during execution?" — a question most deployed guardrails were not designed to answer. It also overlaps with the encoding space a practitioner already cares about, because hiding payload bytes inside trusted content is the same fundamental trick as the zero‑width Unicode steganography documented in the hide text in text: a zero‑width Unicode method guide, just swapped for an encrypted outer shell instead of invisible characters.

What changes for engineers this week

The near‑term action set is concrete. Prompt‑ingestion pipelines that fetch and decrypt external blobs need to be treated as a parsing boundary on par with `JSON.parse` on untrusted input: schema, length and instruction‑shape checks belong there, not inside the model context. Web‑browsing tool surfaces should default to rendering encrypted blobs as inert and refuse to forward them into a model's context window.

Hash‑based payload reputation also becomes more useful, because even when the plaintext is hidden the ciphertext hashes deterministically and can be blocked at the proxy — the same SHA256 Hash Generator and Sha512 Hash Generator routines that already drive integrity checks now have a job inside prompt firewalls. For internal red‑team payloads, the XOR Encryption Online tool is a quick way to reproduce the "wrap a secret and reveal it later" pattern without staging a full cryptographic harness.

What readers should follow up on

No vendor in the evidence has published a fix date or a CVE identifier for the Cryptographic Context Injection chain, and OWASP's 2026 list does not print a phase‑out timeline for the prior edition. Re‑read the OWASP Top 10 release against your current control map once the SHA1 Hash Generator review catches the weak‑hash cases this technique implicitly relies on, and audit every place your AI stack decrypts remote bytes inside a model context. When one of the disclosure authors or the OWASP maintainers posts a fix or a numbered risk, that is the next thing to track.