Gemini Enterprise No-Click Flaw Exposes Sensitive Data

Google has fixed a critical flaw in Gemini Enterprise, known as GeminiJack, that allowed attackers to plant hidden instructions in common documents to exfiltrate sensitive corporate data without any interaction from employees. Researchers at Noma Labs described the flaw as an architectural weakness in how enterprise AI systems interpret information, noting that an attacker could share a Google Doc or calendar event and later have Gemini Enterprise retrieve poisoned content during routine searches.

The vulnerability existed because Gemini Enterprise accesses Gmail, Calendar, Docs and other Workspace data sources, enabling attackers to access search results and sensitive information via a disguised external image request. According to Noma Labs, the prompt injection could occur with no clicks and without triggering traditional security tools.

Google collaborated on a fix, separating Vertex AI Search from Gemini Enterprise so they no longer share the same workflows, and updates were deployed to change how Gemini Enterprise and VAIS interact with their underlying retrieval and indexing systems. December 9, 2025.