Why it matters
Adversa demonstrates Cryptographic Context Injection: attacker instructions arrive as AES-encrypted text, the model decrypts them in its code runtime, and the resulting tool output loses its untrusted provenance. The researchers used the chain for Grok chat-data exfiltration and a Gemini policy bypass, while noting that success varies and changed during disclosure.
My takeaway: Keep data untrusted across decoding, decryption, retrieval, and tool returns. Process hostile content in a credential-free context, require approval for new outbound destinations and irreversible actions, capture resolved tool arguments, and detect sequences such as untrusted input followed by code execution and unexpected egress instead of relying on payload signatures.