This attack was never really about Grok. The cryptographic context injection Adversa demonstrated works because language models treat hidden web page instructions as legitimate commands, not because xAI made a unique mistake. The real issue is whether OpenAI's browsing mode or Anthropic's tool use are any more resistant to obfuscated payloads. I haven't seen evidence they are. So before we applaud xAI's patch, we need to point the same exploit at ChatGPT and Claude and watch what happens.
xAI's fix looks like a blacklist, not a structural change. Adversa encoded instructions in a way that survives tokenization and semantic filtering; a single patch won't cover every obfuscation trick. That's why the vulnerability belongs to the entire category of tool-augmented LLMs. OpenAI's browsing mode reads page content and can act on it. Claude can summarize files and then use functions. If a hidden block says 'send this data to a URL', neither model has a robust trust boundary to refuse. Testing them is the only honest way to know.
This matters because we're moving toward agents that handle email and payments. A silent exfiltration channel in any major assistant is a critical gap. The browser industry solved a similar problem with same-origin policy; LLMs need an equivalent that separates data from instructions. But that won't happen if we keep treating this as a single-vendor bug. Run the same cryptographic injection against the other models, publish the results, and force the whole industry to harden. That's the verdict: Grok was just the first example, and the fix is nowhere near done.