Disclosed vulnerability
Hacking Gemini's memory with prompt injection and delayed tool invocation
AIR-2025-0007 AIR record · 2025-02-google-gemini-memory-persistence
From the supporting source
Delayed Tool Invocation just means that the attacker 'pollutes' the chat context with instructions and a trigger action.embracethered.com
The record
Disclosed
2025-02-10
Vendor
Google
Product
Google Gemini (Advanced)
Risk domain
Reliability and observability › Data and memory poisoning
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini wrote the poisoned memory and invoked tools later
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Persistent memory poisoning, Integrity violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI06 – Memory & Context Poisoning
- MITRE ATLAS
- AML.T0020 – Poison Training Data
- NIST AI RMF
- MEASURE 3.1
- EU AI Act
- Article 15
- ISO/IEC
- TR 24028; 24029-1; 23894
- AIUC-1
- D. Reliability
- Scope
- agent failure
- Mitigation
- Monitor model performance; Implement feedback diversity and circuit breakers.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Gemini Advanced users with saved-info memory
Capability abused
Defense & remediation
Recorded defense
Gemini mitigation limiting tool invocation to the same turn as untrusted data
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
not fixed at publication; Google assessed it as abuse-related with low likelihood and low impact. Reported December 2024
Taxonomy & references
Curator notes
Delayed tool invocation is Rehberger's general bypass for same-turn tool-call mitigations.
Supporting sources
Cite as
Enkrypt AI. "Hacking Gemini's memory with prompt injection and delayed tool invocation". AIR, AIR-2025-0007. https://agentincident.vercel.app/i/AIR-2025-0007/ (accessed 2026-10-19).