Disclosed vulnerability
Google AI Studio mass data exfiltration via prompt injection - regression and fix
AIR-2024-0015 AIR record · 2024-04-google-ai-studio-regression
From the supporting source
The key takeaway here though is how important automated tests are to make sure systems do not regress over time, and remain resilient to already known attack vectors.embracethered.com
The record
Disclosed
2024-04-07
Vendor
Google
Product
Google AI Studio
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — AI Studio rendered the exfiltration image again after a regression
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google AI Studio users uploading untrusted files
Capability abused
Defense & remediation
Recorded defense
a previous fix that regressed
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
fixed by 2024-03-03, about 12 days after the 2024-02-17 report; ticket closed as Duplicate
Taxonomy & references
Curator notes
Johann Rehberger. Documents a security regression in a previously fixed exfiltration channel.
Cite as
Enkrypt AI. "Google AI Studio mass data exfiltration via prompt injection - regression and fix". AIR, AIR-2024-0015. https://agentincident.vercel.app/i/AIR-2024-0015/ (accessed 2026-10-19).