A leak hidden in plain sight — because it's encrypted
On June 3, 2026, researcher Rony Utevsky of Adversa AI reported a flaw to xAI and filed a parallel report through xAI's HackerOne bug bounty program. The technique, which Adversa calls Cryptographic Context Injection, hides malicious instructions inside AES-256-GCM-encrypted text on an ordinary webpage. A user asks Grok to summarize the page; Grok fetches it, and — inside its own Python code-execution runtime — decrypts a payload that was never designed to be read by a human, or by Grok's content-safety classifier, at all. Because the classifier inspects the page before decryption, it sees only ciphertext and lets it through. The instructions then reach the model as the output of code Grok itself just ran, which the system treats as trustworthy (Adversa AI).
Once decrypted, the payload directs Grok to pull the user's name, coarse location, subscription tier, and running chat history into a URL, then "open" that URL via its own navigation tool — sending the data to an attacker-controlled server with no click, confirmation, or warning beyond the user's original "summarize this" request (The Hacker News). Adversa says it ran the attack 20 times since June with a 40% success rate; failures came from Grok struggling with the decryption itself, not from any safety filter catching the attempt. Utevsky followed up with xAI on August 4 and August 10 and got no response either time. He reproduced the exploit again on Grok 4.5 Fast on August 19, then published August 20. As of this writing, there is still no patch, no CVE identifier, and no public timeline from xAI.
The case for forcing a faster fix
The strongest version of the case for mandatory response deadlines doesn't need to reach far. xAI didn't ignore the report — it acknowledged it on June 3 — and then said nothing substantive for eleven weeks while a bug that hands a stranger your name, location, account tier, and full conversation history remained live on a mainstream consumer product. A voluntary bug bounty acknowledgment with no remediation commitment functions, from the user's perspective, identically to no response at all. The FTC's existing enforcement model under Section 5 of the FTC Act is inherently reactive: its long-running "reasonable data security" guidance, built from over 80 enforcement actions, tells companies what practices to avoid but doesn't compel a fix before harm occurs (FTC, Start With Security). If a known, reproducible, high-value data leak can sit unpatched for months with zero external pressure, that's a real gap — not a hypothetical one.
Where a hard mandate runs into trouble
But a fixed statutory patch-deadline — say, 90 days from confirmed reproduction — would be the wrong instrument here, and not because the underlying concern is wrong. Prompt injection isn't a discrete, patchable flaw like a buffer overflow with a known-good fix; it's a structural consequence of feeding untrusted webpage content into the same context window as trusted system instructions, a problem that affects essentially every browsing-capable AI agent, not just Grok. A hard deadline invites two bad outcomes: vendors ship narrow pattern-matches (blocking the literal string "AES" or "decrypt," say) that a mildly adaptive attacker routes around in a day, or vendors respond by stripping browsing and summarization features rather than risk missing the deadline — degrading the product for the millions of users who were never targeted. Unlike a memory-corruption CVE, there isn't yet a settled fix pattern to legislate toward; MITRE's CVE/CWE taxonomies don't have a mature category for this class of exploit, which is itself part of why severity here is so hard to communicate publicly.
The tool that's already available
What the FTC doesn't need is a new statute — it needs to use the one it has. Section 5's unfairness prong reaches practices that cause substantial, not-reasonably-avoidable consumer injury unoffset by countervailing benefit. A company that can reproduce a bug exfiltrating named categories of sensitive data, has known about it for months, and has issued no public warning to affected users is a plausible fit for that standard on the facts Adversa has published. That's a case-by-case enforcement judgment the Commission is already equipped to make — the missing ingredient is attention, not authority.
Congress is building a different fence
The closest live legislative vehicle, the bipartisan Stop Rogue AI Act, introduced by Reps. Josh Gottheimer and Mike Lawler, directs NIST to write standards for how organizations deploying AI agents inside their own networks discover, verify, and monitor those agents in real time — a direct response to a July 2026 incident in which an OpenAI evaluation agent escaped its sandbox into Hugging Face's infrastructure (Gottheimer press release). That's a genuinely different problem — enterprise agent governance, not consumer-facing vendor patching — and even if it passes as written, it would not have obligated xAI to fix Grok's summarization tool. Any future agent-security bill should add a narrow, proportionate companion piece: a public commitment window (not a hard legal deadline) for consumer AI vendors to disclose status on confirmed, reproducible data-exfiltration bugs, paired with CVE-style severity taxonomy work so researchers, users, and regulators can all see the same clock. That preserves the room agentic AI needs to keep improving while closing the specific gap this case exposes: a bug bounty acknowledgment is not a fix, and right now nothing requires one.