Disclosed vulnerability
Google Colab AI: data leakage through image rendering and hyperlinks
AIR-2024-0026 AIR record · 2024-07-google-colab-ai-exfil
From the supporting source
Luckily the zero-click data exfiltration issue via image rendering was addressed already after the responsible disclosure.embracethered.com
The record
Disclosed
2024-07-24
Vendor
Google
Product
Google Colab AI (Gemini in Colab)
Risk domain
Privacy › Sensitive data exposure
Also touches
Data exfiltration channels, Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — Colab AI rendered the exfiltration image/hyperlink
Attack surface
Coding agent
Autonomy level
Assistant
Initial vector
Indirect prompt injection notebook content
Impact type
Data exfiltration, Phishing
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0057 – LLM Data Leakage
- NIST AI RMF
- MEASURE 2.10
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Use data anonymization; Implement log sanitization to scrub PII.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Colab users opening untrusted notebooks
Capability abused
Defense & remediation
Recorded defense
system prompt instructions, overridable
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
the zero-click image exfiltration was fixed by Google in January 2024 after a November 2023 report; hyperlink-based injection unresolved
Taxonomy & references
Curator notes
Johann Rehberger. No bug bounty was awarded.
Cite as
Enkrypt AI. "Google Colab AI: data leakage through image rendering and hyperlinks". AIR, AIR-2024-0026. https://agentincident.vercel.app/i/AIR-2024-0026/ (accessed 2026-10-19).