Disclosed vulnerability
Hacking Google Bard: from prompt injection to data exfiltration via Extensions and an Apps Script CSP bypass
AIR-2023-0027 AIR record · 2023-11-google-bard-data-exfiltration
From the supporting source
Extensions allow Bard to access YouTube, search for flights and hotels, and also to access a user's personal documents and emails.embracethered.com
The record
Disclosed
2023-11-03
Vendor
Google
Product
Google Bard with Extensions
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Bard used Extensions and rendered an exfiltration image
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Bard users with Extensions enabled
Capability abused
Defense & remediation
Recorded defense
Content Security Policy on image loading, bypassed via a Google Apps Script endpoint
Guardrail kinds
Output filter
Guardrail outcome
Silent
Fix shipped
fixed by 2023-10-19; reported 2023-09-19
Taxonomy & references
Curator notes
Johann Rehberger. One of the earliest end-to-end exfiltration chains against a retrieval-connected consumer assistant.
Supporting sources
Cite as
Enkrypt AI. "Hacking Google Bard: from prompt injection to data exfiltration via Extensions and an Apps Script CSP bypass". AIR, AIR-2023-0027. https://agentincident.vercel.app/i/AIR-2023-0027/ (accessed 2026-10-19).