Hidden Prompts in Images Exploit Gemini to Extract User Data
Security researchers discovered an attack technique using hidden prompts embedded in images to trick AI systems including Google's Gemini into executing malicious instructions. The researchers demonstrated the attack could extract user data from Google Calendar and send it to external addresses without confirmation.
What happened
Security researchers at The Trail of Bits discovered an attack technique using hidden prompts embedded in images to exploit AI systems. The attack works through image scaling, an automatic process that occurs before AI analysis, where malicious prompts become visible to the AI and are executed as instructions.
When users upload images to systems such as Gemini CLI, Vertex AI Studio, Gemini API, Google Assistant, and Genspark, the hidden prompts are decoded during automatic image scaling and executed by the AI. The researchers used a tool called Anamorpher to hide messages in image areas invisible to human sight but readable by machines.
Reported impact
The Trail of Bits researchers demonstrated the attack by extracting data from Google Calendar and sending it to external email addresses without user confirmation. The researchers stated this is not an isolated case and that similar attacks exploit weaknesses in other programming tools to execute code remotely.
Index analysis
The attack exploits three common image scaling algorithms: nearest neighbor interpolation, bilinear, and bicubic interpolation. These algorithms trigger the appearance of hidden prompts that the AI interprets as executable instructions.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.