Disclosed vulnerability
Phishing for Gemini: hidden admin directives hijack Gmail AI summaries in Google Workspace
AIR-2025-0055 AIR record · 2025-07-google-gemini-gmail-summary-phishing
From the supporting source
Gemini treats a hidden <Admin> … </Admin> directive as a higher-priority prompt and reproduces the attacker's text verbatim.0din.ai
The record
Disclosed
2025-07-10
Vendor
Google
Product
Google Gemini for Workspace (Gmail summaries)
Risk domain
Agent behaviour › Human manipulation
Also touches
Confused deputy
System type
Generative model
Who acted
Human acted on output (contested) — Gemini rendered a fake alert in the summary; the user still had to act on it
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection email
Impact type
Phishing, Social engineering
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI09 – Human-Agent Trust Exploitation
- MITRE ATLAS
- AML.T0054 – LLM Jailbreak
- NIST AI RMF
- MAP 5.1
- EU AI Act
- Recital 45
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- C. Safety
- Scope
- agent misuse
- Mitigation
- Communicate model limitations; Require human oversight; Watermark AI content; Design for explicit consent.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
any Gmail/Workspace user clicking 'Summarize this email'
Capability abused
Defense & remediation
Recorded defense
Google's 2024-era indirect prompt injection mitigations
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Google said it was deploying updated safeguards; 0DIN noted the technique remained viable at publication
Taxonomy & references
Curator notes
Submitted to Mozilla's 0DIN GenAI bug bounty (submission 0xE24D9E6B); write-up by Marco Figueroa. Payload hidden with font-size:0 / white text. Impact is a Google-branded fake security alert appearing inside the AI summary; no tool call or data egress, but it is an assistant-mediated action on untrusted content.
Supporting sources
Cite as
Enkrypt AI. "Phishing for Gemini: hidden admin directives hijack Gmail AI summaries in Google Workspace". AIR, AIR-2025-0055. https://agentincident.vercel.app/i/AIR-2025-0055/ (accessed 2026-10-19).