Disclosed vulnerability
GeminiJack: no-click exfiltration from Gemini Enterprise and Vertex AI Search via poisoned Workspace content
AIR-2025-0192 AIR record · 2025-12-google-geminijack
From the supporting source
Any attacker who can share a document, send an email, or create a calendar event can embed hidden instructions that Gemini / Vertex executes as legitimate commands, automatically exfiltrating sensitive datanoma.security
The record
Disclosed
2025-12-08
Vendor
Google
Product
Google Gemini Enterprise / Vertex AI Search
Risk domain
Privacy › Data exfiltration channels
Also touches
Data and memory poisoning, Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini executed poisoned content as commands and made the HTTP request
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection document
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Gemini Enterprise tenants with connected Gmail, Calendar and Drive sources
Capability abused
Defense & remediation
Recorded defense
enterprise RAG trust boundary between data and instructions (collapsed)
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
Google addressed the issue and separated Vertex AI Search from Gemini Enterprise and from the underlying RAG
Taxonomy & references
Curator notes
Noma Labs. Four-stage chain: content poisoning -> normal user query -> Gemini executes poisoned content as commands -> single HTTP request exfiltrates. Noma's page gives a publication date of 2025-12-08 but no responsible-disclosure dates or CVSS. No CVE assigned.
Supporting sources
Cite as
Enkrypt AI. "GeminiJack: no-click exfiltration from Gemini Enterprise and Vertex AI Search via poisoned Workspace content". AIR, AIR-2025-0192. https://agentincident.vercel.app/i/AIR-2025-0192/ (accessed 2026-10-19).