Planting Instructions for Delayed Automatic AI Agent Tool Invocation
Date: 2024-02-01
Affected: Google Gemini
Attack vector: adversarial-input
Category: research
Severity: High

[Embrace the Red](https://embracethered.com/blog/) demonstrated that Google Gemini is susceptible to automated tool invocation by delaying the execution to the next conversation turn. This bypasses a security control that restricts Gemini from invoking tools that can access sensitive user information in the same conversation turn that untrusted data enters context.


Mitigations:

Architectural layers (MAESTRO):