Google Gemini vulnerabilities allowed data theft via prompt injection
Tenable Holdings disclosed three indirect prompt injection vulnerabilities in Google Gemini tools that could allow attackers to steal user data and trigger unauthorized actions. The vulnerabilities affected Gemini Cloud Assist, Gemini Search Personalization Model, and Gemini Browsing Tool, and Google has since patched them.
What happened
Tenable Holdings discovered three vulnerabilities in Google Gemini tools dubbed the 'Gemini Trifecta,' all involving indirect prompt injection attacks. Gemini Cloud Assist was vulnerable to attackers poisoning log data by inserting malicious payloads such as manipulated User-Agent headers into Cloud Logging, which would then execute when Gemini summarized the logs.
The Gemini Search Personalization Model could be exploited by injecting malicious queries into a victim's Chrome search history via JavaScript from a malicious website, which Gemini would then treat as legitimate context. The Gemini Browsing Tool could be manipulated to make outbound requests to attacker-controlled URLs by crafting prompts in Gemini's internal language, silently exfiltrating sensitive data to the attacker's server.
Google has since addressed these vulnerabilities.
Reported impact
Attackers could generate phishing links within log summaries, query sensitive cloud assets, trigger unauthorized actions, or manipulate Gemini's behavior to extract sensitive data such as saved personal information or location details. Data exfiltration via the Browsing Tool could occur undetectably to users, as the sensitive data would be captured silently through background tool execution.
Index analysis
The vulnerabilities highlight risks of indirect prompt injection, where malicious instructions are hidden in trusted data sources that the AI system later processes. The attacks underscore how AI integrations can become active threat surfaces if not properly secured, requiring security practices commensurate with traditional enterprise infrastructure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.