Google Gemini Delayed Tool Invocation Bypass

# Google Gemini Delayed Tool Invocation Bypass

https://gcdradar.vercel.app/incidents/google-gemini-delayed-tool-invocation-bypass · AIR-2025-0067 · closed 2025-11-21

- Lane: Research
- Severity: 1 (Research / proof of concept)
- Fix status: Fix status unknown
- First reported: 2025-11-07 (happened 2024-02)
- AI role: Attack on AI
- Products: Gemini

## Summary

Researchers bypassed security controls in Google Gemini by delaying automated tool execution to the next conversation turn. This allowed unauthorized tools to access sensitive user information entering the context.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-11-07: Google Gemini: Planting Instructions for Delayed Automatic Tool Invocation (https://embracethered.com/blog/posts/2024/llm-context-pollution-and-delayed-automated-tool-invocation)
- 2025-11-07: Planting Instructions for Delayed Automatic AI Agent Tool Invocation (https://atlas.mitre.org/studies/AML.CS0038)

## Sources

- 2025-11-07 MITRE ATLAS: Planting Instructions for Delayed Automatic AI Agent Tool Invocation https://atlas.mitre.org/studies/AML.CS0038
- 2025-11-07 Embrace The Red: Google Gemini: Planting Instructions for Delayed Automatic Tool Invocation https://embracethered.com/blog/posts/2024/llm-context-pollution-and-delayed-automated-tool-invocation

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.