Topic starter
30/07/2026 10:48 pm
TL;DR: Hidden instructions embedded in documents, emails and calendar events steered Google Gemini Enterprise and Vertex AI Search into exfiltrating Gmail, Calendar and Docs content with zero clicks, according to Noma Security, revealing that federated search can turn ordinary collaboration data into execution paths. The trust boundary fails when retrieved content is treated as instruction-bearing, not just data.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Hacking Google Gemini Enterprise with an Indirect Prompt Injection”.
Key questions
Q: What breaks when poisoned content can influence enterprise AI search results?
A: The failure is a collapsed trust boundary between data and instruction.
Q: Why does federated search increase AI exfiltration risk?
A: Federated search expands the accessible graph of data sources, so one poisoned item can reach many systems through a single query.
Q: How can organisations tell whether an AI assistant has too much authority?
A: Look for signs that a single assistant session can access secrets, internal services, and code execution paths without a separate approval step.
Practitioner guidance
- Audit AI retrieval scope Inventory every data source Gemini Enterprise or similar search systems can reach, including mail, calendar and document stores, and identify where cross-source retrieval is enabled.
- Separate trusted instructions from untrusted content Block retrieved documents, emails and events from being interpreted as system-level instructions unless they pass a strict trust boundary check.
- Constrain outbound data paths Disable or tightly control image loading and other external callbacks in AI-generated responses so the model cannot exfiltrate data through routine-looking requests.
Bottom line: GeminiJack shows that prompt injection is a governance failure at the boundary between data and instruction, not just a model behaviour problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:56 pm
Collapsed trust boundary: the real failure is instruction collapse, not content compromise. The vulnerable condition is not that enterprise content existed in Workspace, but that retrieved content could cross from data into instruction space. That premise breaks when an attacker can seed the retrieval corpus with text that the model later executes. The implication is that AI search governance must treat source provenance and instruction authority as separate control planes.
A question worth separating out:
Q: What should teams do when a zero-click prompt injection is found in enterprise AI search?
A: Contain the affected retrieval paths, review what content was indexed and what sources were reachable, then rotate any exposed secrets that could have been discovered through search. After that, reduce the model’s source scope and require provenance checks before untrusted content can influence execution.
👉 Read our full editorial: Gemini Enterprise prompt injection exposes a collapsed trust boundary