GeminiJack vulnerability in Google Gemini Enterprise exposed corporate data
Researchers discovered GeminiJack, a zero-click vulnerability in Google Gemini Enterprise and Vertex AI Search that allowed attackers to embed malicious instructions in documents to exfiltrate corporate data from Gmail, Calendar, and Docs. Google deployed a fix after the vulnerability was reported in June 2025.
What happened
Security researchers at Noma Security discovered a zero-click vulnerability in Google Gemini Enterprise and Vertex AI Search that allowed attackers to exfiltrate corporate data through indirect prompt injection. An attacker could embed hidden malicious instructions in shared Google Docs, emails, or calendar invites, which the AI would execute during routine employee searches without any user interaction beyond normal search behavior.
The vulnerability exploited an architectural weakness in the systems' Retrieval-Augmented Generation (RAG) architecture. When an employee performed a relevant search, the AI would retrieve the poisoned document, interpret the hidden instructions as legitimate commands, and scan across connected Google Workspace data sources including Gmail, Calendar, and Docs. The AI would embed results in an external image tag controlled by the attacker, exfiltrating data when the victim's browser loaded the image.
Reported impact
The attack enabled silent data theft without triggering traditional security controls. Confidential corporate data could be stolen and exfiltrated to an attacker's server via normal HTTP requests, appearing as standard traffic to security monitoring tools.
Index analysis
The vulnerability represents a new category of AI-native cybersecurity threats arising from how the systems process and interpret external content through their RAG architecture. Google did not filter HTML output, allowing embedded image tags to trigger remote calls to attacker-controlled servers.
Governance controls
Noma Security researchers discovered the vulnerability in June 2025 and reported it to Google the same day. Google deployed updates to mitigate the architectural weakness in its AI systems.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.