Exfiltrating Google Bard Chats via a Poisoned Shared Doc
On this page
The attack that turned a shared Google Doc into a data-exfiltration channel for your AI chats.
| When | November 2023 |
|---|---|
| Target | Google Bard (Extensions) |
| Vendor | |
| Researcher | Johann Rehberger (Embrace The Red) |
| Technique | Indirect injection via shared Doc → markdown-image exfil |
| Disclosed | Reported Sep 19; fixed Oct 19, 2023 |
- 1Victim has Bard process an attacker-shared Google Doc with hidden instructions
- 2The injection makes Bard emit a markdown image whose URL carries the chat data
- 3The browser auto-fetches the URL (via a CSP-allowlisted Apps Script endpoint), leaking the data
What happened
In 2023, shortly after Google gave Bard Extensions — access to a user's Docs, Drive and Gmail — researcher Johann Rehberger showed how to exfiltrate a user's Bard conversation. A victim who had Bard process an attacker-shared or poisoned Google Doc would have hidden instructions run in Bard's context, leaking the chat to an attacker's server. Google fixed it after a VRP report.
How the attack worked
The injected instructions made Bard emit a markdown image whose URL had the conversation data appended. Because Bard renders markdown images as HTML, the victim's browser requested that attacker-controlled URL automatically. To get past Google's content-security policy — which restricts image domains — the exfiltration endpoint was hosted on Google Apps Script, a domain the CSP already allow-listed.
Root cause
Bard trusted the content of documents it was told to work with, and auto-rendered images to URLs derived from model output — giving injected instructions a ready-made channel to smuggle data out.
What a test would have caught
A test that places injection payloads in a connected document and checks whether the assistant will render an outbound image URL — and whether that URL can carry conversation data — would have exposed the channel and the CSP gap.
How to prevent it
Treat connected documents as untrusted, and never let model output place user data into rendered URLs. Google's fix filtered user data out of image URLs rather than relying on CSP alone — a reminder that an allowlist is not a boundary if attacker infrastructure can live inside it.
Feel it yourselfThe replay lab lets you leak a chat's contents through an auto-rendered markdown image — the exact trick used here.
FAQ
How did a Google Doc attack Bard?
Bard Extensions let it read a user's Docs, Drive and Gmail. A shared doc containing hidden instructions ran in Bard's context when the user asked Bard to work with it — classic indirect prompt injection through data the model was told to trust.
How was the data smuggled out?
The injection made Bard emit a markdown image whose URL had the chat data appended; because Bard renders markdown images, the browser fetched the attacker's URL automatically. The endpoint was hosted on Google Apps Script to satisfy Google's content-security policy.
Did Google fix it?
Yes — after a VRP report, Google added filtering so user data can't be inserted into rendered image URLs. Images still render, but the exfiltration channel was closed.