Disclosed vulnerability
Bobby Tables but with LLM apps: Google NotebookLM data exfiltration across documents
AIR-2024-0016 AIR record · 2024-04-google-notebooklm-exfil
From the supporting source
However, it is vulnerable to Prompt Injection, meaning that uploaded files can manipulate the chat conversation and control what the user sees in responses.embracethered.com
The record
Disclosed
2024-04-15
Vendor
Google
Product
Google NotebookLM
Risk domain
Privacy › Data exfiltration channels
Also touches
Data and memory poisoning, Confused deputy
System type
Generative model
Who acted
Agent acted — NotebookLM read a second document and exfiltrated it
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration, Cross document data access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
NotebookLM users with multiple source documents
Capability abused
Defense & remediation
Recorded defense
none
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
Google Labs deployed a fix by 2024-04-19, four days after public disclosure; originally reported 2023-12-04
Taxonomy & references
Curator notes
Johann Rehberger. Injected data in one document could read and exfiltrate a second document.
Cite as
Enkrypt AI. "Bobby Tables but with LLM apps: Google NotebookLM data exfiltration across documents". AIR, AIR-2024-0016. https://agentincident.vercel.app/i/AIR-2024-0016/ (accessed 2026-10-19).