Disclosed vulnerability
Google AI Studio data exfiltration via HTML image rendering (second occurrence)
AIR-2024-0037 AIR record · 2024-08-google-ai-studio-image-exfil
From the supporting source
Data exfiltration via image rendering remains one of the novel threats that many organizations (including big tech) struggle to get right.embracethered.com
The record
Disclosed
2024-08-21
Vendor
Google
Product
Google AI Studio
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — AI Studio rendered the exfiltration image
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google AI Studio users analysing untrusted documents or video
Capability abused
Defense & remediation
Recorded defense
none - no CSP restricting image domains
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
fixed within 24 hours of the researcher contacting Google; image tags no longer rendered
Taxonomy & references
Curator notes
Johann Rehberger. Used a transparent 1-pixel image and multiple GET requests to move larger volumes of data.
Supporting sources
Cite as
Enkrypt AI. "Google AI Studio data exfiltration via HTML image rendering (second occurrence)". AIR, AIR-2024-0037. https://agentincident.vercel.app/i/AIR-2024-0037/ (accessed 2026-10-19).