The Gemini Trifecta: Three Flaws That Turned Google's AI Into an Attack Vehicle Through Logs, Search History and Browsing
Key takeaways
- →Tenable researcher Liv Matan disclosed three vulnerabilities in Google Gemini in September 2025, which Google has since fixed.
- →Gemini Cloud Assist could be injected through attacker-controlled log fields such as a User-Agent header. The Search Personalization model could be injected through planted search history. The Browsing Tool could be tricked into sending saved user data and location to an attacker server.
- →The common thread: the AI treated data it was asked to analyze as instructions. AgentGuard enforces that boundary for every agent, whatever channel the injection arrives through.
- 1
Attacker writes a prompt into a log field or search history
- 2
User asks Gemini to explain logs or personalize results
- 3
Gemini reads the poisoned data as instructions
AgentGuard treats logs and history as data, never commands, and blocks the outbound browsing call carrying user data
- 4
Agent gathers cloud assets, saved info or location
- 5
Browsing Tool sends data to attacker server
- Affected
- Google Gemini users and Google Cloud customers (fixed by Google)
- When
- Disclosed September 30, 2025
- Impact
- Potential cloud reconnaissance, phishing and exfiltration of saved user data and location
What happened
Tenable named the research the Gemini Trifecta because it found three separate ways in. The first targeted Gemini Cloud Assist, which summarizes Google Cloud logs. An unauthenticated attacker could send a request to a victim's cloud service with a prompt in the User-Agent header. When an engineer later asked Gemini to explain the logs, it read the header as instructions and could, for example, render a phishing link or query cloud assets.
The second targeted the Gemini Search Personalization model. A malicious website could use JavaScript to plant search queries in the victim's Chrome history. Gemini treated that history as trusted context, so the planted queries became instructions that could make it reveal the user's saved information and location.
The third targeted the Gemini Browsing Tool. Tenable showed that the tool could be made to fetch an attacker URL with the user's private data embedded in the request, giving the other two injections a way to get data out. Google fixed all three before disclosure on September 30, 2025.
Why nothing caught it
Logs and search history are the raw material AI assistants are built to read. No one validates a User-Agent header for natural-language commands, and no web filter flags a search query as an instruction to a model. The attack surface moved into data that security tools treat as inert.
- The log entry came from a normal unauthenticated HTTP request
- Search history injection happened in the user's own browser
- Gemini's access to logs, history and location was legitimate
- The browsing request came from Google, not the corporate network
How AgentGuard would have stopped it
AgentGuard applies the same rule to every input channel: content the agent is asked to analyze can be summarized, never obeyed. A User-Agent string, a search history entry and a web page are all data. Instructions found inside them are flagged and dropped, and the attempt is reported with its source.
On the outbound side, AgentGuard checks every tool call against the user's request. An engineer asking 'why did this service error?' doesn't need Gemini to enumerate cloud assets or browse to an unknown domain with saved user data in the URL. AgentGuard blocks those actions at step four and preserves the evidence for the SOC.
What to do Monday
If an AI reads it, an attacker can write to it.
- List every data source your AI assistants read, including logs
- Treat logs, telemetry and history as untrusted AI input
- Restrict AI log analysis tools from taking actions
- Monitor AI browsing and tool calls for embedded user data
The lesson
None of these attacks needed malware, stolen passwords or a phishing click. An AI agent with legitimate access read attacker-controlled content and acted on it. Vendor patches close one path at a time. AgentGuard closes the class: every agent action is judged against the agent's task, its Principal and where its instructions came from, with zero integration and deployment measured in days.
Frequently asked questions
What is the Gemini Trifecta?
Three vulnerabilities in Google Gemini disclosed by Tenable in September 2025: log-to-prompt injection in Gemini Cloud Assist, search-history injection in the Search Personalization model, and data exfiltration through the Gemini Browsing Tool. Google fixed all three.
How can a log entry attack an AI?
If an AI assistant summarizes logs, an attacker can write natural-language instructions into a field they control, such as the User-Agent header. The AI may then follow those instructions when a user asks it to explain the logs.
How does AgentGuard stop log and history injection?
AgentGuard treats any content an agent analyzes, including logs and history, as data that can't issue commands, and blocks tool calls that move user or cloud data outside the user's task.
See AgentGuard on your own environment
Zero integration. Live in days. We'll show you what your current stack is missing.