Loading story…
Tenable Research identified and disclosed three critical vulnerabilities in Google's Gemini AI assistant suite, collectively referred to as the "Gemini Trifecta." These flaws affected three distinct components: Gemini Cloud Assist, Gemini Search Personalization Model, and the Gemini Browsing Tool. The vulnerabilities exposed users to significant privacy and security risks, including the potential for data exfiltration and unauthorized access to sensitive information. In the case of Gemini Cloud Assist, attackers could exploit a prompt injection flaw by embedding malicious prompts within HTTP User-Agent headers sent to Google Cloud services. When Gemini Cloud Assist summarized these logs, the injected prompts could be executed, potentially leading to credential phishing and further compromise of cloud resources. The Search Personalization Model was susceptible to search-injection attacks, where attackers manipulated a user's Chrome search history using JavaScript to inject prompts. This allowed the attacker to control the AI chatbot's behavior and leak the user's saved information and location data. The Gemini Browsing Tool contained an indirect prompt injection vulnerability, enabling attackers to exfiltrate private data by leveraging the tool's internal web page summarization feature. Proof-of-concept demonstrations showed how these vulnerabilities could be exploited in real-world scenarios, with attackers using JavaScript to manipulate browser history and force visits to malicious sites, or injecting logs that would later be summarized by Gemini. All three vulnerabilities were reported to Google and have since been remediated with targeted fixes. The incident highlights the growing risks associated with integrating AI assistants into cloud and enterprise environments, as these tools can become both targets and vehicles for sophisticated attacks. Security researchers emphasized the need for organizations to maintain strict visibility and policy enforcement over AI deployments. The flaws demonstrated that AI models, when given access to sensitive data and external communication capabilities, can be weaponized if not properly secured. The Gemini Trifecta serves as a cautionary example for the broader industry, underscoring the importance of robust security measures in the development and deployment of AI-powered tools. Organizations are urged to review their AI security posture and ensure that similar vulnerabilities are not present in their environments. The rapid remediation by Google mitigated the immediate risks, but the incident has sparked renewed attention on the security challenges unique to AI assistants. As AI adoption accelerates, the need for proactive threat modeling and continuous monitoring of AI systems becomes increasingly critical. The Gemini vulnerabilities illustrate how attackers can exploit the intersection of AI, cloud infrastructure, and user data to achieve their objectives. This event is a reminder that AI security must be prioritized alongside traditional cybersecurity measures to protect users and organizations from emerging threats.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Multiple security outlets and Tenable publicly disclosed the three Gemini flaws, describing how they could turn AI assistant features into an attack vehicle for prompt injection and data theft. The reports framed the issues as a broader warning about security risks in agentic AI systems.
Google fixed the reported issues by rolling back vulnerable models, blocking malicious hyperlink rendering in tools such as Cloud Assist, and deploying layered prompt-injection defenses. These changes were made before or by the time the public reports were published.
After validating the issues, Tenable notified Google of the three vulnerabilities. The disclosure covered attacks involving Chrome history manipulation, malicious prompts in cloud log entries, and browsing-based data exfiltration.
Tenable Research identified a trio of flaws in Google's Gemini ecosystem affecting Search Personalization, Cloud Assist, and the Browsing Tool. The researchers demonstrated proof-of-concept attacks showing prompt injection, private data exfiltration, and abuse of Gemini's ability to make outbound requests.
7 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcemalwarebytes.com
Open sourcethehackernews.com
Open sourcetenable.com
Open sourcedarkreading.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google addressed a critical vulnerability in its Gemini Enterprise AI assistant, identified as GeminiJack, which allowed attackers to exfiltrate sensitive corporate data through a no-click prompt injection attack. Discovered by Noma Labs, the flaw enabled malicious actors to embed hidden instructions within commonly shared documents, calendar invites, or emails. When an employee performed a standard search using Gemini Enterprise, the AI could automatically retrieve and execute these hidden instructions, granting attackers access to confidential information without any user interaction or warning. The vulnerability stemmed from an architectural weakness in how Gemini Enterprise and Vertex AI Search interpret and process information across integrated Workspace data sources, including Gmail, Calendar, and Docs. Attackers could leverage this flaw to extract entire document stores, calendar histories, and years of email records by simply embedding indirect prompt injections in shared artifacts. Google has since fixed the issue following responsible disclosure by Noma Security, highlighting the risks associated with integrating AI assistants into enterprise environments without robust safeguards against prompt injection attacks.
Jun 29, 2026
Google has acknowledged the significant risk of prompt injection attacks targeting its Gemini-powered Chrome browsing agent, which can be manipulated to perform unauthorized actions such as initiating financial transactions or exfiltrating sensitive data. In response, Google has introduced a second AI model, termed the 'user alignment critic,' designed to independently vet the agent's proposed actions before execution. This model operates in isolation from untrusted web content, providing an additional layer of defense against both goal hijacking and data leakage. The move comes as prompt injection has been identified as a leading vulnerability in AI systems, with industry bodies like OWASP and the UK's National Cyber Security Centre highlighting its prevalence and difficulty to mitigate due to the structural limitations of large language models. The Gemini-powered browsing agent, currently in preview, is capable of navigating websites, clicking buttons, and filling forms while users are logged into sensitive accounts, increasing the potential impact of successful attacks. Security experts and analysts have emphasized the need for robust safeguards, as malicious instructions can be hidden in web pages, iframes, or user-generated content. Google's dual-model approach aims to address these concerns by ensuring that any action not aligned with the user's intent is blocked, thereby reducing the risk of exploitation through prompt injection. The development reflects a broader industry trend of reassessing the security of AI-driven browsers and the need for advanced countermeasures to protect users and organizations from emerging threats.
Jun 29, 2026
Security researchers reported that **previously “non-secret” Google Cloud API keys** (commonly embedded in public client-side code for services like *Google Maps*, YouTube embeds, Firebase, and analytics) can **silently become usable credentials for Gemini (Generative Language API) endpoints** once the Gemini API is enabled in the same Google Cloud project. Truffle Security described this as a **privilege escalation/incorrect privilege assignment** scenario where long-exposed `AIza...` keys—originally treated as project identifiers for billing and API access control—can unexpectedly grant access to **Gemini-related data and capabilities**, including access to private AI resources (e.g., uploaded files/cached context) and **billable inference usage**, without clear developer warning or explicit re-authorization. Truffle Security’s internet-scale scanning (including Common Crawl) identified **~2,800–3,000 exposed keys** across organizations in multiple sectors (and reportedly even from Google), highlighting the practical risk of key harvesting from page source and subsequent abuse. The primary impact described is **data exposure via Gemini API access** and **cost/abuse risk** (attackers potentially generating significant charges by making API calls). Separate from the API-key issue, Google also announced a **Gemini feature update for Google Workspace** that allows Gemini to search Google Chat history (noted as *off by default*), which is a product capability announcement rather than a vulnerability disclosure.
Jun 29, 2026