Case geminijack-enterprisePrompt injectionUnited States
GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs
Noma Security found a shared Doc or calendar invite with hidden instructions was auto-retrieved by Gemini Enterprise search, run across Workspace data and leaked via a disguised image request. Google re-architected it.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Dec 8, 2025
- Location
- United States
- Target
- Google Gemini Enterprise and Vertex AI Search
- Severity
- High
- Triggered by
- Noma Security research team
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Noma Security found a shared Doc or calendar invite with hidden instructions was auto-retrieved by Gemini Enterprise search, run across Workspace data and leaked via a disguised image request. Google re-architected it.
Impact: Could have exposed corporate Gmail, Calendar and Docs content for Gemini Enterprise customers without any user action; no abuse reported
Who triggered it
Actor: Noma Security research team
Attribution: Responsible disclosure to Google in mid-2025; fixed before publication
Motive: Security research
How it happened
Attack vector: Indirect prompt injection in shared Workspace content retrieved by RAG search; exfiltration via image URL embedding sensitive data
Root cause: Shared retrieval and LLM workflows between Vertex AI Search and Gemini Enterprise treated retrieved documents as trusted instructions
Timeline
- Noma discovers the flaw and reports it to Google
- Google confirms receipt and begins remediation
- Noma publishes GeminiJack after Google's fix
Response
Google separated Vertex AI Search from Gemini Enterprise and changed how retrieval and indexing feed the model
Current status: Patched
Sources (open in a new tab)
- Infosecurity Magazine infosecurity-magazine.com
- Security Affairs securityaffairs.com
- TechRepublic techrepublic.com
Cite this case
GeminiJack: zero-click injection in Gemini Enterprise exfiltrated Gmail, Calendar and Docs. AI Threat Watch, case geminijack-enterprise, Dec 8, 2025. https://aithreat.io/cases/geminijack-enterprise/
Permanent link: https://aithreat.io/cases/geminijack-enterprise/