Disclosed vulnerability
Gemini Trifecta: log-to-prompt, search-history and browsing-tool injection across Google's Gemini suite
AIR-2025-0140 AIR record · 2025-09-google-gemini-trifecta
From the supporting source
The GCP product team made a change to stop rendering hyperlinks in the responses for all log summarization responsestenable.com
The record
Disclosed
2025-09-30
Vendor
Google
Product
Gemini Cloud Assist, Gemini Search Personalization Model, Gemini Browsing Tool
Risk domain
Privacy › Data exfiltration channels
Also touches
Sensitive data exposure, Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini ingested poisoned logs and made outbound requests
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection multi
Impact type
Data exfiltration, Phishing, Privacy violation, Unauthorized cloud access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Google Cloud tenants using Gemini Cloud Assist; Gemini users with saved information and location data
Capability abused
Defense & remediation
Recorded defense
partial; Gemini did not sufficiently separate user input from attacker-supplied content
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Google stopped rendering hyperlinks in log summarization responses, hardened search personalization, and blocked exfiltration from the browsing tool in indirect prompt injections
Taxonomy & references
Curator notes
Tenable Research (Liv Matan). Cloud Assist injection was delivered through an HTTP User-Agent header that lands in Cloud Logging and is later summarized by Gemini; a pure log-to-prompt path. The Search Personalization vector overlaps with the browser-agent records. All three were remediated before publication; no CVEs assigned. Also reported as: 'Gemini Trifecta: log injection, search-history injection and browsing-tool exfiltration in Google's Gemini suite'.
Supporting sources
Cite as
Enkrypt AI. "Gemini Trifecta: log-to-prompt, search-history and browsing-tool injection across Google's Gemini suite". AIR, AIR-2025-0140. https://agentincident.vercel.app/i/AIR-2025-0140/ (accessed 2026-10-19).