AIA-022 "Gemini Trifecta": three prompt-injection flaws in Gemini Cloud Assist, Search Personalization and Browsing Tool, per Tenable

ID: AIA-022
Category: AI AI agent incident
Disclosed: 2025-09
Systems: Google Gemini
Harm type: Prompt injection / data leak
Status: fixed
Tenable says the three vulnerabilities are "now remediated".

Summary

Tenable Research reported three vulnerabilities, "now remediated": log-to-prompt injection in Gemini Cloud Assist, search injection in the Search Personalization Model, and "exfiltration of the user's saved information and location data via the Gemini Browsing Tool."

Controls

Controls that could prevent, detect, or support recovery from this kind of failure. Mappings are editorial judgments made by the method, not findings about what any party should have done.

NIST AI RMF

MEASURE 2.7 Security and resilience are evaluated and documented
MAP 4.1 Risks from third-party components are mapped

NIST SP 800-53

SI-10 Information Input Validation
AC-4 Information Flow Enforcement

Human-approval (JCR) checkpoint

partial: Browsing Tool exfiltration (the other two flaws were on the read/answer path)

Sources

tenable.com primary link checked 2026-10-31, HTTP 200
Post dated Sep 30, 2025
https://www.tenable.com/blog/the-trifecta-how-three-new-gemini-vulnerabilities-in-cloud-assist-search-model-and-browsing

Corrections

No corrections recorded.

To report an error in this entry, see corrections.