Loading story…
Google Workspace is allowing Gemini to access organizational data by default, letting the assistant retrieve information from Gmail, Docs, Drive, Calendar, Meet, and Chat to answer user prompts. Google says the feature uses retrieval-augmented generation (RAG) to search indexed Workspace content in real time and return results only from data a user is already authorized to access, and that Workspace content, prompts, and responses are not used to train generative AI models without permission.
The default setting has raised enterprise concerns around privacy, compliance, governance, and insider risk, because sensitive internal information can be surfaced, summarized, and redistributed more easily inside an organization even without external data sharing. Administrators can disable Workspace "intelligence sources" across the organization in the Google Workspace admin console, while more granular per-user restrictions may require separate organizational units or groups.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Google allows Gemini to access Google Workspace data sources by default, including Gmail, Docs, Drive, Calendar, Meet, and Chat. The articles describe this as use of Workspace "intelligence sources" with existing access controls and retrieval-augmented generation rather than model training on customer data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcezdnet.fr
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google expanded **Gemini Personal Intelligence** beyond paid subscribers, making the feature available to more free U.S. users across **AI Mode in Search**, the **Gemini app**, and **Gemini in Chrome**. The feature connects Gemini to personal Google services such as **Gmail**, **Google Photos**, **YouTube**, and **Search history**—with user permission—so it can provide more contextual, personalized responses instead of generic answers. Reported use cases include shopping recommendations based on prior purchases, travel and layover suggestions tailored to preferences and location, and troubleshooting help informed by a user’s device or purchase history. Google said the capability is **opt-in** and lets users choose which apps and services to connect, with the option to disconnect them later. Coverage of the rollout emphasized the amount of personal context Gemini can access, including email, photos, and search activity, and noted that the feature was previously limited to users paying for Google’s AI subscription. One report highlighted a hands-on test in which Gemini identified vehicle details and recommended tire options and local sellers, illustrating the depth of personalization now being offered to a broader user base.
Jun 29, 2026
Security researchers reported that **previously “non-secret” Google Cloud API keys** (commonly embedded in public client-side code for services like *Google Maps*, YouTube embeds, Firebase, and analytics) can **silently become usable credentials for Gemini (Generative Language API) endpoints** once the Gemini API is enabled in the same Google Cloud project. Truffle Security described this as a **privilege escalation/incorrect privilege assignment** scenario where long-exposed `AIza...` keys—originally treated as project identifiers for billing and API access control—can unexpectedly grant access to **Gemini-related data and capabilities**, including access to private AI resources (e.g., uploaded files/cached context) and **billable inference usage**, without clear developer warning or explicit re-authorization. Truffle Security’s internet-scale scanning (including Common Crawl) identified **~2,800–3,000 exposed keys** across organizations in multiple sectors (and reportedly even from Google), highlighting the practical risk of key harvesting from page source and subsequent abuse. The primary impact described is **data exposure via Gemini API access** and **cost/abuse risk** (attackers potentially generating significant charges by making API calls). Separate from the API-key issue, Google also announced a **Gemini feature update for Google Workspace** that allows Gemini to search Google Chat history (noted as *off by default*), which is a product capability announcement rather than a vulnerability disclosure.
Jun 29, 2026
Google addressed a critical vulnerability in its Gemini Enterprise AI assistant, identified as GeminiJack, which allowed attackers to exfiltrate sensitive corporate data through a no-click prompt injection attack. Discovered by Noma Labs, the flaw enabled malicious actors to embed hidden instructions within commonly shared documents, calendar invites, or emails. When an employee performed a standard search using Gemini Enterprise, the AI could automatically retrieve and execute these hidden instructions, granting attackers access to confidential information without any user interaction or warning. The vulnerability stemmed from an architectural weakness in how Gemini Enterprise and Vertex AI Search interpret and process information across integrated Workspace data sources, including Gmail, Calendar, and Docs. Attackers could leverage this flaw to extract entire document stores, calendar histories, and years of email records by simply embedding indirect prompt injections in shared artifacts. Google has since fixed the issue following responsible disclosure by Noma Security, highlighting the risks associated with integrating AI assistants into enterprise environments without robust safeguards against prompt injection attacks.
Jun 29, 2026