GeminiJack — zero-click Gemini Enterprise data exfiltration via shared Google Docs
Date: 2026-01
Affected: Gemini Enterprise — Google Workspace email, calendar, documents
Attack vector: indirect-prompt-injection
Category: research-demonstrated
Severity: Critical

Indirect prompt injection via shared Google Docs, calendar invites, or emails causes Gemini Enterprise to search for sensitive terms and embed results in an external image URL. A single poisoned document could exfiltrate years of email, calendar, and document data with zero clicks, zero warnings, and zero DLP alerts.

Impact: Silent zero-click exfiltration of enterprise data; invisible to security teams and DLP

Mitigations:
Block external image loading in AI-generated content
Content sanitization for shared documents
DLP monitoring for AI-mediated data access patterns

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Gemini processes attacker-controlled document content
role: origin
label: Data Operations
notes: Years of email, calendar, and documents exfiltrated
role: impact