GeminiJack zero-click flaw in Gemini Enterprise allowed corporate data exfiltration

GeminiJack is a zero-click flaw in Gemini Enterprise that could leak corporate data via crafted emails, invites or documents, according to Noma Security. Google fixed the vulnerability after the researchers reported it. Gemini Enterprise is Google’s AI-powered productivity platform for businesses, integrating generative AI into Gmail, Calendar, Docs and other Workspace apps.

The attack relies on indirect prompt injection: attackers create a normal-looking Google Doc, Calendar event, or Gmail and share it with someone in the organisation, embedding instructions to direct Gemini Enterprise to search for sensitive terms and load the results into an external image URL controlled by the attacker.

When a regular employee performs a normal search, Gemini Enterprise pulls the poisoned content into its context and executes queries across Workspace data, exfiltrating results by embedding them in an image tag that sends data to the attacker’s server. A single injection could exfiltrate years of emails, full calendars and entire document repositories. The discovery occurred during a security assessment on 5 June 2025 and was reported to Google on the same day.