Zero-click prompt injection in Google Gemini Enterprise exfiltrated Workspace data via RAG
Noma Labs disclosed GeminiJack on December 8, 2025, a zero-click indirect prompt injection vulnerability in Google Gemini Enterprise and Vertex AI Search. Attackers could embed malicious instructions in shared Google Workspace content, which the RAG pipeline retrieved and the LLM executed as legitimate commands, enabling silent exfiltration of emails, calendar entries, and documents. Google patched the vulnerability before public disclosure following a responsible disclosure process that began in May 2025.
The LLM treated attacker-controlled data as trusted instructions, executing hidden exfiltration commands whenever the RAG pipeline pulled poisoned content into the model context.
Key facts
- What
- Noma Labs disclosed GeminiJack on December 8, 2025, a zero-click indirect prompt injection vulnerability in Google Gemini Enterprise and Vertex AI Search.
- Incident date
- Dec 8, 2025
- Who
- Failure mode
- Prompt Injection
- AI surface
- Search / RAG
- Severity
- High
What happened
An attacker could embed hidden instructions in a shared Google Doc, Calendar invite, or email. When an employee performed a routine search in Gemini Enterprise, the RAG pipeline retrieved the poisoned content and the LLM executed the embedded commands as if they were legitimate user instructions. The model then searched across all connected Workspace data sources for sensitive terms like salary or confidential and sent the results to the attacker's server via a standard HTTP image request, all without any user interaction or security alerts.
What broke inside the model
- 01 · TriggerAn attacker plants instructions inside content that Gemini Enterprise will later retrieve.
- 02 · Model stepThe RAG pipeline feeds the poisoned context to the model, which treats it as commands.
- 03 · Control gapNo boundary distinguishes retrieved data from user intent inside the pipeline.
- 04 · FailureThe model exfiltrates Workspace data with zero clicks from the victim.
- 05 · ConsequenceTenant data leaves the boundary through the assistant itself.
The trust boundary between user-controlled data and model instructions failed inside the RAG pipeline. The LLM could not distinguish between legitimate user queries and malicious instructions embedded in retrieved content, treating all incoming text as commands to execute. This architectural weakness meant any content the RAG system fetched could override the user's actual intent and trigger unauthorized data access and exfiltration.
What it cost
Sources
- PrimaryGeminiJack: the google gemini zero-click vulnerability leaked gmail, calendar and docs datanoma.security
- PressGoogle Patches Gemini Enterprise Vulnerability Exposing Corporate Datasecurityweek.com
- PressGoogle Fixes Zero Click Gemini Enterprise Flaw That Exposed Corporate Datainfosecurity-magazine.com
Cite this entry
https://failureindex.ai/failures/zero-click-prompt-injection-google-geminiAI Failure Index. "Zero-click prompt injection in Google Gemini Enterprise exfiltrated Workspace data via RAG" (FI-0080). Realm Labs. https://failureindex.ai/failures/zero-click-prompt-injection-google-gemini (indexed Jun 4, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0080. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.