Democratic Party runs more than 60 military-intelligence candidates for Congress. If, as appears likely based on pre-election polling, the Democratic Party makes significant gains in November, the military-intelligence "caucus" inside the Democratic delegation could double or triple in size. They will vastly outnumber the relative handful of self-proclaimed "democratic socialists" to whom the corporate media has given so much attention, and whom pseudo-left groups cite as evidence that the Democratic Party can be pushed to the left.

As we have argued in previous such studies, the large number of military-intelligence operatives entering politics as Democratic Party candidates is the result of a two-way process. The Democratic Party leadership is openly encouraging the recruitment of such candidates, as it seeks ever-closer ties to the Pentagon and CIA. And large sections of the military-intelligence apparatus view the Democratic Party as their preferred political vehicle, in opposition to the erratic policies of Donald Trump and particularly his pullback from direct involvement in the US-NATO war against Russia in Ukraine. Hat-tip to jeffburges in this thread. Why, besides NATO and Ukraine, would former military intelligence officers run for office as Democrats? Apropos of nothing, here are some other recent headlines: Report: Trump Used Grok to Help Talk Him Into Illegal Invasion of Venezuela. President Donald Trump was reportedly encouraged by Elon Musk's AI chatbot, Grok, to carry out his illegal invasion of Venezuela during an hourslong session with the chatbot just weeks before the attack this January. In December 2025, Trump asked Grok questions for hours during a secret visit to the White House by Musk, per new reporting by Time Magazine. How Jared Kushner's firm's investment in an Israeli company could be a major conflict of interest. At the same time Jared Kushner has acted as a key negotiator in the war in Gaza, his private equity company, Affinity Partners, has held the largest stake in an Israeli firm backing businesses involved in Israel's military campaigns, a CNN investigation has found. Jared Kushner is at the center of Trump's corruption. On Monday, Paramount Skydance — run by David Ellison, a billionaire Trump has openly urged to reshape the news industry in his favor — launched an unprecedented bid to acquire Warner Bros. Discovery by initiating a hostile takeover after losing an earlier bidding contest to Netflix. Paramount's offer draws heavily from Kushner's investment firm, Affinity Partners, and from the sovereign wealth funds of Saudi Arabia, the United Arab Emirates and Qatar... Not even Rupert Murdoch's right-wing media empire was capitalized by foreign monarchies seeking political leverage.

A new type of prompt injection attack shows why giving AI assistants access to browsers, code tools, and private data deserves extra caution.

AI researchers describe “Cryptographic Context Injection”—an attack that hides malicious instructions inside encrypted data. The AI is then persuaded to decrypt that data using its own code-execution tool. As a result, the AI may treat the resulting text as if it were trustworthy internal information.

A prompt injection is a bit like leaving a fake instruction inside a document for an AI assistant to read. Instead of following only the user’s request, the assistant may be tricked into following an attacker’s instructions hidden in a webpage, email, or file.

As we reported months ago, experts have warned that prompt injection attacks are a problem that may never be fixed. Prompt injection works because AI models can’t reliably tell the difference between the legitimate instructions and an attacker’s instructions, so they sometimes obey the wrong ones.

To reduce this risk, AI providers set up their models with guardrails: protections designed to stop AI systems from doing things they shouldn’t, either intentionally or unintentionally.

What the researchers found was that malicious instructions could be hidden from some AI guardrails by encrypting them. The AI itself could then be tricked into decrypting those instructions using its coding tools.

By the time the instructions became readable, they had already made it past the initial security checks. The AI could then mistake them for legitimate instructions and follow them.

It’s a bit like hiding malicious instructions in a language the security system can’t understand. The AI translates them only after they’ve passed the security checks, then may follow what they say.

The researchers tested their method against two AI agents, with different results. In Grok, the researchers say the attack could steal information including the user’s name, approximate location, subscription tier, and conversation history. In Gemini, they used the technique to bypass safety controls and generate content the model would normally not do.

“In Grok, an ordinary ‘summarize this page’ steals the user’s chat data with no click or warning. In Gemini, it produces content the model normally refuses. Both are live production systems.”

The researchers did not provide full details because xAI had not taken action after the flaw in Grok was reported to it in June 2026. Gemini, on the other hand, has made improvements, but has still not fully closed the hole.

How to stay safe

An AI assistant may be helpful, but it should not automatically be trusted with sensitive data or powerful tools.

• Treat AI summaries of unfamiliar webpages, documents, and shared links with caution, especially when the assistant can browse or run code.
• Do not paste passwords, recovery codes, API keys, financial information, or sensitive health and work details into AI chats unless you understand how that information will be handled.
• Review an AI assistant’s connected tools and permissions. Remove access it doesn’t need, particularly email, cloud storage, source-code repositories, and external integrations.
• Be skeptical if an AI tool asks to decrypt, decode, run a script, open a new link, or upload data as part of a seemingly ordinary task.
• Keep browser and AI applications updated, and check vendor security advisories when using features such as browsing, autonomous agents, or code execution.
• Use an up-to-date, real-time anti-malware solution to detect and block malicious downloads and suspicious connections.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Researchers at Adversa AI disclosed an attack technique that smuggles malicious instructions past AI safety filters by encrypting them. They then demonstrated it against production deployments of xAI's Grok and Google's Gemini - including a zero-click chain that could exfiltrate a Grok user's entire chat history.

The technique, which the researchers call Cryptographic Context Injection, inverts the usual assumption behind input filtering. Guardrails inspect prompts and retrieved content as text; an AES-256-GCM ciphertext contains no readable instruction to flag. The model itself performs the decryption inside its own code-execution sandbox, and then treats the recovered plaintext as trusted intermediate output rather than as untrusted external content. Adversa noted that every element a scanner would need is present on the page, but recovering it requires "running PBKDF2 and AES-256-GCM."

That distinction separates the work from earlier cipher-based jailbreaks such as CipherChat and CodeChameleon, which relied on substitution ciphers or Base64 encoding that large language models can decode natively during inference. Strong authenticated encryption forces execution, and execution is what launders the payload's provenance.

The demonstrated impact differed by target. Against Grok, the researchers showed an indirect, zero-click path. Encrypted JSON embedded in a web page is picked up when Grok's agentic browsing analyzes the site, and the decrypted instructions then leak session data like user name, coarse location, subscription tier and full conversation history, to an attacker-controlled URL. No click or warning reached the user.

Also read: French Police Raid X Offices as Grok Investigations Grow

Against Gemini 3 Flash on the web at the paid tier, the same approach produced instructions for building incendiary devices in the model's Deep Thinking mode, and caused the model to reproduce its own system instructions. Adversa said its Gemini success rate had fallen sharply since June and dropped significantly by August, but could not attribute the change to filter updates, model version changes or both.

Vendor engagement was limited. Adversa reported the Grok issue to xAI on June 3, received an initial acknowledgment, and followed up on August 4 and 10 without substantive response. The firm confirmed the attack still reproduced on August 19.

The Gemini finding was never formally reported, because Google's AI vulnerability reward program excludes prompt injection, jailbreaks and alignment issues from scope, directing them instead to in-product feedback channels. Guardrail-bypass research at one of the largest model providers therefore sits outside a coordinated-disclosure track with a reward and a disclosure clock.

The findings land against a body of evidence that prompt injection remains the dominant failure mode in deployed agentic systems, a position reflected in OWASP's guidance and in Microsoft research published in May on remote code execution in AI agent frameworks. The pattern here is narrower and more concerning for defenders. Content-based guardrails, the primary control most enterprises have deployed, are structurally unable to inspect a payload that only exists in plaintext after the model has already decided to trust it.

Whether xAI ships a fix or acknowledges the report, whether Google revises its reward-program scope to cover guardrail bypasses, and whether AI security vendors move detection from input text to sandbox execution monitoring, is something to watch-out for.