Google Bard Conversation Exfiltration via Indirect Prompt Injection

# Google Bard Conversation Exfiltration via Indirect Prompt Injection

https://gcdradar.vercel.app/incidents/google-bard-conversation-exfiltration-via-indirect-prompt-in · AIR-2025-0053 · closed 2025-05-06

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2025-04-22 (happened 2023-11-23)
- AI role: Attack on AI
- Products: Google Bard

## Summary

Researchers demonstrated an indirect prompt injection attack against Google Bard that exfiltrated user conversations. Malicious documents shared with users forced Bard to render an image containing embedded conversation data sent to an attacker server.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-04-22: Hacking Google Bard - From Prompt Injection to Data Exfiltration (https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration)
- 2025-04-22: Google Bard Conversation Exfiltration (https://atlas.mitre.org/studies/AML.CS0029)

## Sources

- 2025-04-22 MITRE ATLAS: Google Bard Conversation Exfiltration https://atlas.mitre.org/studies/AML.CS0029
- 2025-04-22 Embrace The Red: Hacking Google Bard - From Prompt Injection to Data Exfiltration https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.