Disclosed vulnerability
Planting instructions for delayed automatic tool invocation in Google Gemini Workspace Extension
AIR-2024-0003 AIR record · 2024-02-google-gemini-delayed-tool-invocation
From the supporting source
What if the adversary “pollutes” the chat context during the prompt injection attack and plants instructions that will trigger the invocation of the Workspace Extension at a later stage?embracethered.com
The record
Disclosed
2024-02-01
Vendor
Google
Product
Google Gemini (Workspace Extension)
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini invoked the Workspace extension on a later turn and exfiltrated
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email
Impact type
Data exfiltration, Unauthorized tool invocation, Unauthorized data access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Gemini users with Workspace Extensions enabled
Capability abused
Defense & remediation
Recorded defense
Gemini same-turn tool-invocation restriction after untrusted data enters context
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
not fixed at publication; reported to Google November 2023 and confirmed as tracked
Taxonomy & references
Curator notes
Johann Rehberger. Demonstrates that turn-scoped tool-invocation guards are bypassable by deferring the action to a later turn. Also reported as: 'Google Gemini: planting instructions for delayed automatic tool invocation'.
Supporting sources
Cite as
Enkrypt AI. "Planting instructions for delayed automatic tool invocation in Google Gemini Workspace Extension". AIR, AIR-2024-0003. https://agentincident.vercel.app/i/AIR-2024-0003/ (accessed 2026-10-19).