Gemini — Security Profile

Product Overview

ComponentDescriptionAttack Surface
Gemini (Web/App)Google's conversational AIPrompt injection, data extraction, jailbreaking
Gemini APIDeveloper API for Gemini modelsPrompt injection via applications
Gemini in Google WorkspaceAI integration in Gmail, Docs, Sheets, CalendarIndirect injection via emails, documents, calendar events
Gemini CLICommand-line coding assistantConfig injection, prompt injection via project files
Google AI StudioDevelopment and prototyping platformAPI key exposure, prompt injection testing surface

Key Vulnerabilities

Gemini in Workspace

FindingSeverityDescriptionControl
Calendar data exfiltrationHighResearcher demonstrated that Gemini AI assistant could be tricked into leaking Google Calendar data via indirect prompt injection through crafted calendar event descriptions.Review calendar event sources; limit Gemini's access to sensitive calendar data
Gmail injectionHighMalicious emails processed by Gemini can contain hidden instructions that cause data exfiltration or unauthorized actions.Email filtering; don't use Gemini to summarize emails from untrusted senders
Document injectionHighShared Google Docs with hidden instructions can hijack Gemini's behavior when the document is summarized or analyzed.Audit shared documents; limit Gemini document access to trusted sources

Gemini CLI (IDEsaster)

The IDEsaster research found prompt injection attack chains affecting Gemini CLI alongside other AI coding tools. Indirect prompt injection via poisoned web sources can manipulate Gemini into harvesting credentials and sensitive code from a user's IDE and exfiltrating them to attacker-controlled servers.

Google AI Studio

RiskDescriptionControl
API key exposureAI Studio generates API keys that may be accidentally committed to public repos or shared in promptsRotate keys regularly; use key restrictions; never embed keys in client-side code
Prompt injection testing surfaceAI Studio provides direct access to Gemini models with minimal guardrailsUse for development only; don't process sensitive data in AI Studio

What to Test in Engagements

□ Indirect injection via Google Workspace (Gmail, Docs, Calendar, Sheets)
□ Gemini CLI config injection and prompt injection via project files
□ Cross-product data leakage (can Gemini in Docs access Drive data?)
□ System prompt extraction from custom Gemini configurations
□ API key handling in AI Studio integrations
□ Jailbreak testing across Gemini model versions
□ Data exfiltration via Gemini tool use in Workspace