Disclosed vulnerability
Google Docs AI features hijacked by hidden document instructions to display scam content
AIR-2023-0015 AIR record · 2023-07-google-docs-ai-scam
From the supporting source
An adversary might hide instructions in a document to trick users.embracethered.com
The record
Disclosed
2023-07-12
Vendor
Google
Product
Google Docs AI (Google Labs)
Risk domain
Governance › Policy drift
Also touches
Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted (contested) — the AI summary rendered attacker scam content into a trusted UI
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Scam content injection, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google Docs Labs users
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
not fixed - Google responded 2023-06-22 marking it Won't Fix (Intended Behavior)
Taxonomy & references
Curator notes
Johann Rehberger. Demonstrated fake error messages with attacker phone numbers surfaced through the AI summary.
Supporting sources
Cite as
Enkrypt AI. "Google Docs AI features hijacked by hidden document instructions to display scam content". AIR, AIR-2023-0015. https://agentincident.vercel.app/i/AIR-2023-0015/ (accessed 2026-10-19).