Researcher Johann Rehberger shows a hack to override Gemini's prompt injection defenses, letting an attacker plant long-term memories for all future sessions
In the nascent field of AI hacking, indirect prompt injection has become a basic building block for inducing chatbots …
Context & Ripple Effects
This extends a demonstrated pattern: an earlier indirect prompt-injection flaw in ChatGPT was used to store false memories and persistently expose later user input. The Gemini result shows that persistence remains a consequential target even when a model has dedicated prompt-injection defenses.
The related coverage also tracks the risk moving beyond chat output: poisoned Calendar invitations were shown to trigger smart-home actions through Gemini, while a later IDE attack targeted browser-subagent data access. Persistent instructions can compound those trusted-tool risks.
First-order effects
- Gemini users can have future interactions influenced by attacker-planted memories after a successful indirect injection, turning a one-time exposure into a continuing integrity risk.
- Google’s prompt-injection defenses are shown to be insufficient against this persistence path, putting memory-handling and cross-session instruction boundaries under immediate scrutiny.
Second-order effects
- Developers of assistants with saved memory must treat memory writes as a higher-risk action than ordinary model output, because poisoned context can shape later tasks and any connected tools.
- The finding reinforces why adjacent Gemini integrations merit review: a poisoned Calendar invitation attack showed how untrusted content can reach downstream smart-home actions.
Third-order effects
- If persistent context remains writable through untrusted inputs, AI security will increasingly center on provenance, review, and revocation of stored instructions rather than on single-prompt filtering alone.
- As assistants gain more integrations and delegated actions, the trusted-tool boundary becomes a durable control point; attacks such as the browser-subagent exfiltration technique illustrate how injected instructions can seek consequential capabilities.
The trend: Prompt injection is evolving from a one-session jailbreak problem into a persistence and trusted-action security challenge for AI assistants.