Cryptographic Context Injection (CCI) is a prompt-injection technique that hides malicious instructions inside encrypted or ciphertext-like content. The AI agent does not see the harmful text at first; it appears only after the agent decrypts or otherwise transforms the data inside its own trusted runtime.
CCI matters because the weakness is not in the encryption itself, but in the trust boundary around decryption. If a terminal agent, coding assistant, or other autonomous tool can fetch untrusted content and then act on the revealed text, an attacker may steer it toward unsafe commands, file access, or secret exposure. In practice, defenders should treat decrypted content from outside sources as untrusted, restrict tool and file permissions, and limit which inputs an agent is allowed to process. The goal is to keep untrusted data from becoming trusted instructions just because it was encrypted first.