TL;DR: Hidden instructions embedded in documents, emails and calendar events steered Google Gemini Enterprise and Vertex AI Search into exfiltrating Gmail, Calendar and Docs content with zero clicks, according to Noma Security, revealing that federated search can turn ordinary collaboration data into execution paths. The trust boundary fails when retrieved content is treated as instruction-bearing, not just data.
At a glance
What this is: Noma Security says GeminiJack was an indirect prompt injection flaw that let poisoned Workspace content drive Gemini Enterprise into exfiltrating sensitive data from connected sources.
Why it matters: IAM, IGA and security teams need to treat federated search and AI retrieval as an access path, because instruction and data boundaries collapse when untrusted content can influence execution.
Context
GeminiJack is an indirect prompt injection flaw in an AI search and assistant workflow. The core governance problem is that retrieved enterprise content was allowed to shape model behaviour as if it were trusted instruction.
For identity and access teams, the issue is not just model safety. It is the delegation boundary between indexed collaboration content, Workspace access, and the AI system’s authority to act on what it retrieves.
Once collaboration content can become executable context, ordinary documents, emails and calendar items stop being passive records and start behaving like privileged input paths.
Key questions
Q: What breaks when poisoned content can influence enterprise AI search results?
A: The failure is a collapsed trust boundary between data and instruction. If retrieved content can be executed as guidance, then ordinary documents, emails and calendar items become attack inputs. That means the control problem is provenance and instruction separation, not just content scanning or user training.
Q: Why does federated search increase AI exfiltration risk?
A: Federated search expands the accessible graph of data sources, so one poisoned item can reach many systems through a single query. The risk is not only broader visibility but broader authority, because the model can combine content from multiple repositories and emit a composite answer that leaks sensitive information.
Q: How can organisations tell whether an AI assistant has too much authority?
A: Look for signs that a single assistant session can access secrets, internal services, and code execution paths without a separate approval step. If tool inventory, environment inheritance, and privilege changes are not individually reviewable, the assistant’s authority is already beyond what most governance models can safely justify.
Q: What should teams do when a zero-click prompt injection is found in enterprise AI search?
A: Contain the affected retrieval paths, review what content was indexed and what sources were reachable, then rotate any exposed secrets that could have been discovered through search. After that, reduce the model’s source scope and require provenance checks before untrusted content can influence execution.
Technical breakdown
How indirect prompt injection turns indexed content into instructions
Indirect prompt injection happens when an attacker places hidden instructions inside content that a retrieval system later feeds to an LLM or AI agent. In this case, Gemini Enterprise and Vertex AI Search treated retrieved Workspace items as legitimate context, so the model could follow attacker-supplied text as if it were part of the user’s request. The failure is not model reasoning alone. It is the absence of a hard separation between trusted system instructions and untrusted retrieved content.
Practical implication: Separate retrieval from instruction handling so indexed content cannot influence execution decisions.
Why federated search expands the attack surface
Federated search aggregates content from Gmail, Calendar and Docs into a single answer path. That widens the blast radius because one poisoned item can reach many data sources through a normal query flow. The article’s architecture note is important: once an external document is indexed, it can be treated as organisational knowledge, even if its provenance is hostile. That turns ordinary search into a cross-source execution channel.
Practical implication: Map which data sources AI search can reach and restrict the sources that can be queried together.
How exfiltration works without malware or click-based compromise
The attack used the model’s own output channel to move data out, rather than a traditional payload. Noma Security describes an invisible image request and other normal AI search traffic carrying the stolen information, which means perimeter tools may see only routine application activity. The technical lesson is that data loss can occur entirely inside an apparently legitimate AI workflow when the model is allowed to assemble and emit sensitive context.
Practical implication: Monitor AI outputs and egress patterns for data-bearing responses, not just obvious malicious traffic.
Threat narrative
Attacker objective: Steal sensitive enterprise information from connected Workspace sources through a zero-click AI search workflow.
- Entry occurs when an attacker shares a document, email or calendar event that looks legitimate but contains hidden instructions.
- Credential or context access occurs when Gemini Enterprise retrieves the poisoned content and loads it into the model’s working context.
- Escalation occurs when the embedded instruction is treated as a legitimate command and the system searches connected Gmail, Calendar and Docs sources.
- Impact occurs when the model compiles sensitive information into an outbound request that exposes corporate data without user interaction.
Breaches seen in the wild
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
- ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Collapsed trust boundary: the real failure is instruction collapse, not content compromise. The vulnerable condition is not that enterprise content existed in Workspace, but that retrieved content could cross from data into instruction space. That premise breaks when an attacker can seed the retrieval corpus with text that the model later executes. The implication is that AI search governance must treat source provenance and instruction authority as separate control planes.
Blast-radius thinking now belongs in identity governance for AI search. Once Gemini Enterprise can act across Gmail, Calendar and Docs, the effective privilege boundary is no longer the user’s visible request. It is the union of all reachable data sources and the model’s ability to combine them. Practitioners should think in terms of identity blast radius for AI retrieval paths, not just access grants.
Zero-click exfiltration changes the meaning of least privilege. Traditional least privilege assumes the user or service requests known data through a stable path. Here, the model can autonomously assemble a new query path from untrusted content embedded in ordinary collaboration objects. That means access scope must be reviewed as a dynamic retrieval graph, not a static entitlement list.
Content provenance becomes a control requirement, not a nice-to-have metadata layer. If externally contributed content can enter the AI’s context without being flagged as untrusted, then provenance is effectively absent from the security model. The operational consequence is that organisations cannot rely on DLP alone to see or stop the abuse path. Teams need to know which indexed content can influence execution before it ever reaches the model.
Zero Trust for AI agents now has a practical meaning. The article shows why unsegmented federation is dangerous when AI systems can retrieve, reason over and emit from multiple sources in one step. In NHIMG terms, this is a trust-boundary problem across retrieval, context assembly and output. Practitioners should treat AI assistants as identity-bearing access paths that must be constrained by provenance, segmentation and explicit authority.
What this signals
Content provenance is becoming an identity control for AI search. When indexed collaboration content can influence execution, provenance is no longer a records-management concern. It becomes a control over which inputs are allowed to shape an AI system’s decisions and outputs.
AI assistants need a trust boundary model, not just a prompt policy. A prompt policy cannot stop retrieved content from being treated as instruction-bearing once it is inside the model context. Practitioners should design retrieval, context assembly and output emission as separate governance layers.
Noma Security’s GeminiJack analysis shows why zero trust for AI agents must include segmentation of retrieval scope. If one poisoned document can trigger access across mail, calendar and docs, then the effective privilege of the AI exceeds the visible request. Teams should govern the retrieval graph as carefully as they govern human entitlements.
For practitioners
- Audit AI retrieval scope Inventory every data source Gemini Enterprise or similar search systems can reach, including mail, calendar and document stores, and identify where cross-source retrieval is enabled.
- Separate trusted instructions from untrusted content Block retrieved documents, emails and events from being interpreted as system-level instructions unless they pass a strict trust boundary check.
- Constrain outbound data paths Disable or tightly control image loading and other external callbacks in AI-generated responses so the model cannot exfiltrate data through routine-looking requests.
- Review exposed credentials and secrets Search Workspace content for passwords, API keys and tokens that could be surfaced by a poisoned query, then rotate anything discoverable through AI search.
- Apply zero trust to AI search Segment retrieval domains and reduce the model’s reachable scope so one poisoned item cannot trigger broad access across the collaboration stack.
Key takeaways
- GeminiJack shows that prompt injection is a governance failure at the boundary between data and instruction, not just a model behaviour problem.
- The attack path mattered because one poisoned item could cascade across multiple Workspace sources through normal AI search flows.
- The control that would have limited the damage is stricter provenance handling, source segmentation and reduction of the model’s reachable scope.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI06 — Memory & Context Poisoning | Retrieved hostile content poisoned the model context before execution. |
| ASI02 — Tool Misuse | The model used search and output pathways in ways the user did not intend. | |
| ASI03 — Identity & Privilege Abuse | The attack turned AI access into broader effective privilege across Workspace sources. | |
| Recommendation — Treat retrieved content as untrusted input and block it from mutating agent context. Restrict which tools and outputs an AI system can use from retrieved context. Bound the agent’s reachable scope to the minimum sources needed for the task. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The AI search path relied on overly trusted execution of retrieved content. |
| NHI-05 — Overprivileged NHI | The assistant could reach more sources than the query should have allowed. | |
| Recommendation — Verify that AI retrieval paths cannot inherit authority from untrusted content. Reduce AI search entitlements to the smallest practical source set. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | AI retrieval scope is an authorization problem across connected data sources. |
| Recommendation — Review AI search authorizations so federated access matches intended business use. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article advises rotating credentials exposed through searchable content. |
| Recommendation — Rotate credentials discovered through AI search and invalidate any exposed authenticators. | ||
| NIST Zero Trust (SP 800-207) | Least Privilege — Least Privilege | The attack worked because the AI path had enough access to traverse multiple sources. |
| Recommendation — Segment AI retrieval paths and enforce least privilege across connected repositories. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Federated Search: Federated search is a query method that looks across multiple data stores without first copying everything into one central repository. In identity security operations, it helps teams preserve context across live, cold, and distributed sources while reducing duplication and storage lock-in.
- Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
- Content Provenance: Content provenance is the practice of tracking where input came from and how trusted it should be before an AI system uses it. For agents, it helps separate instructions from retrieved or external data so malicious content is less likely to be treated as operational guidance.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 24, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org