Cryptographic Context Injection (CCI) is a prompt-injection technique that hides attacker instructions inside encrypted or otherwise protected content until an AI agent decrypts or interprets that content at runtime. The payload is not obvious in plain text, so simple filters, static review, and keyword matching may miss it. When the agent processes the content, the hidden instructions can influence tool use, file access, or network requests. This makes CCI especially relevant for terminal agents and other assistants that can both read local data and act on it.
CCI matters because it turns content trust into an execution problem: the agent may treat fetched data as input while also treating it as instruction. In attacks, the goal is often to steer the model toward reading sensitive files or sending data outward. Defenses focus on provenance and containment: decrypt and inspect untrusted content outside privileged workflows, limit tool permissions, restrict outbound destinations, and log actual file and network actions. Strong sandboxing and least privilege reduce the impact even if the model is manipulated.