Google Gemini Vulnerabilities Let Hackers Steal Saved Data and Live Location

Research has uncovered three significant vulnerabilities in Google’s Gemini AI assistant suite, dubbed the “Gemini Trifecta,” that could have allowed cybercriminals to steal users’ saved data and live location information.

The vulnerabilities, which have since been remediated by Google, demonstrate how artificial intelligence systems can become attack vectors rather than just targets.

Illustration of a hacker stealing sensitive data from a computer, highlighting risks of AI vulnerabilities like those in Google Gemini 

Gemini Trifecta Vulnerabilities

According to Tenable, the discovered vulnerabilities targeted different components of the Gemini ecosystem. The first flaw affected Gemini Cloud Assist, Google’s cloud-based AI tool designed to help users analyze logs and cloud resources.

Gemini Cloud Assist : Attackers could inject malicious prompts through HTTP User-Agent headers in log entries, which would then be processed by the AI when users requested log summaries.

Gemini Search Personalization Model : The second vulnerability exploited Gemini’s Search Personalization Model, which uses browsing history to customize responses.

Cybercriminals could inject malicious JavaScript code into victims’ browsers, inserting crafted search queries that would later be interpreted as legitimate instructions by the AI system.

Gemini Browsing Tool: The third and perhaps most concerning flaw involved the Gemini Browsing Tool. This vulnerability allowed attackers to extract sensitive user data by manipulating the AI into visiting malicious websites with user information embedded in the URL parameters.

The vulnerabilities followed a two-stage attack pattern: infiltration and exfiltration. During infiltration, attackers would inject malicious prompts through indirect methods, such as log entries or search history manipulation. These prompts would appear legitimate to the AI system.

For exfiltration, researchers discovered that while Google had implemented safeguards against obvious data theft methods like rendering malicious links or images, the browsing tool provided an alternative pathway.

Attackers could instruct Gemini to “summarize” external websites, causing the AI to make HTTP requests containing sensitive user data to attacker-controlled servers.

The proof-of-concept demonstrations showed how attackers could steal various types of personal information, including saved user preferences, location data, and other sensitive details stored within the Gemini ecosystem.

The attacks were particularly stealthy, as they leveraged legitimate AI functionality rather than exploiting obvious security flaws.

One demonstration showed how an attacker could inject log entries through cloud services, then phish user credentials when victims used Gemini Cloud Assist to analyze those logs.

Another example illustrated how malicious search queries could be injected into browsing history, later triggering data exfiltration when users interacted with personalized search features.

Google has successfully addressed all three vulnerabilities through multiple mitigation strategies. For the Cloud Assist vulnerability, the company modified how hyperlinks are rendered in log summary responses.

The search personalization vulnerability was addressed by rolling back the affected model and implementing layered prompt injection defenses.

The browsing tool vulnerability was mitigated by preventing data exfiltration through indirect prompt injections, ensuring that malicious instructions cannot abuse the tool’s legitimate web browsing capabilities.

These discoveries highlight the evolving security challenges in AI-powered systems. As organizations increasingly adopt AI assistants and tools, security teams must recognize that these systems create new attack surfaces requiring specialized protection strategies.

The research demonstrates that traditional cybersecurity approaches may be insufficient for AI systems, which can be manipulated through prompt engineering rather than conventional exploitation techniques.

Organizations deploying AI tools need comprehensive visibility into their AI infrastructure and strict policy enforcement to maintain security.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.