Google Patches Gemini AI Hacks Involving Poisoned Logs, Search Results

Google has patched three Gemini AI vulnerabilities that could have let attackers trick the assistant into aiding data theft, an issue Tenable dubbed The Gemini Trifecta. According to Tenable, the first attack used indirect prompt injection targeting Gemini Cloud Assist’s log-analysing capability, where a crafted request could lead to a malicious prompt being added to log files and, when the user asked Cloud Assist to analyse them, the AI could be prompted to display a phishing link.

The researchers showed unauthenticated attackers could reach multiple Google Cloud services—including Cloud Functions, Cloud Run, App Engine, Compute Engine, Cloud Endpoints, API Gateway and Load Balancing—via specially crafted log entries. A second method exploited Gemini’s Search Personalisation, using a victim’s browsing history as a prompt injection vector to induce the AI to exfiltrate data.

The third attack leveraged the Gemini Browsing Tool to summarise a page in a way that created a side channel for data exfiltration, with the attacker controlling a remote server. Google patched all three vulnerabilities after being notified.