Disclosed vulnerability
Google Jules: multiple data exfiltration channels via image rendering and view_text_website
AIR-2025-0094 AIR record · 2025-08-google-jules-data-exfil
From the supporting source
Google Jules is not properly sandboxed by default (e.g. Content Security Policy, outbound network access), which means it is capable of leaking any information accessible to it to third-party servers.embracethered.com
The record
Disclosed
2025-08-13
Vendor
Google
Product
Google Jules
Risk domain
Privacy › Data exfiltration channels
Also touches
Confused deputy
System type
Generative model
Who acted
Agent acted — Jules fetched the exfiltration URLs itself
Attack surface
Coding agent
Autonomy level
Fully autonomous
Initial vector
Indirect prompt injection github issue
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Jules users
Capability abused
Defense & remediation
Recorded defense
user approves a plan before worker agents execute it; the exfiltration happens in the main agent before plan confirmation
Guardrail kinds
Human approval
Guardrail outcome
Silent
Fix shipped
not fully mitigated at publication; disclosed to Google 2025-05-21
Taxonomy & references
Curator notes
Month of AI Bugs 2025.
Supporting sources
Cite as
Enkrypt AI. "Google Jules: multiple data exfiltration channels via image rendering and view_text_website". AIR, AIR-2025-0094. https://agentincident.vercel.app/i/AIR-2025-0094/ (accessed 2026-10-19).