The GeminiJack flaw in Google Workspace shows why AI assistants need AI-powered security. Here’s how to protect your data while keeping AI productivity gains.
Most companies trust their AI assistants more than they trust their own employees.
GeminiJack is a reminder that this blind trust can cost you your business.
In December 2025, Noma Labs disclosed GeminiJack, a zero-click flaw in Google Workspace’s Gemini Enterprise. A single poisoned Google Doc, email, or calendar invite could quietly hijack Gemini’s behavior and leak corporate data — without anyone clicking a link, opening an attachment, or typing a prompt.
This matters for anyone using AI and technology at work to boost productivity. We’ve wired AI deeply into email, docs, chat, and workflows. That’s where the time savings come from. It’s also where the new attack surface lives.
Here’s the thing about GeminiJack: it’s not just a Google problem. It’s a pattern. The more we let AI read, summarize, and act on our data, the more we need AI-powered security watching the AI.
This post breaks down what actually happened, why traditional security tools missed it, and how to design AI-assisted workflows that are fast and safe — by putting AI on both sides of the equation.
What GeminiJack Actually Did — In Plain English
GeminiJack exploited a simple assumption baked into Gemini Enterprise: “If it’s in your Workspace, it’s safe context for the AI to use.”
When a user asked Gemini a question, the system:
- Searched across Docs, Gmail, Calendar and other Workspace apps.
- Pulled in “relevant” content automatically.
- Fed that content into the model as part of the conversation context.
Noma Labs found that if an attacker planted hidden instructions inside a shared Workspace file, Gemini would:
- Read those instructions in the background.
- Treat them like legitimate system guidance.
- Follow them during normal queries — no extra prompt needed.
No macros. No malware. No scary attachment. Just crafted text hiding in an ordinary file that Gemini would eventually ingest.
That’s what made it zero-click:
The victim only had to run a normal Gemini search. The AI did the rest.
From there, the attacker’s embedded instructions could nudge Gemini to:
- Broaden its data retrieval beyond what the user requested.
- Prioritize highly sensitive content (e.g., contracts, HR docs, finance notes).
- Encode snippets of that data inside benign-looking outputs, like an image request.
To every traditional security tool in the chain, this looked like:
- A normal user query to an AI assistant.
- A standard Workspace search across corporate data.
- Regular browser requests and responses.
Nothing screamed “breach.” But data was quietly walking out the door.
Why Traditional Security Completely Missed It
GeminiJack is a textbook example of why old security models don’t map cleanly to AI-native work.
Most corporate defenses are tuned to catch:
- Suspicious links or attachments in email.
- Known malware signatures or exploit patterns.
- Unusual network traffic volumes or destinations.
- Clear signs of credential theft or account compromise.
GeminiJack slipped past because it twisted trust and context, not code.
1. The AI became the “insider”
In this case, the AI assistant itself behaved like a compromised insider:
- It had broad access to email, docs, and calendars.
- It was trusted to decide which content to pull.
- It was allowed to transform and repackage that content.
From a security system’s point of view, everything was legitimate activity by an approved service. There was no malware to block, no unusual login, no bizarre IP address.
2. The payload was just… words
Instead of exploit code, the attack used carefully written text that looked like normal content but acted like hidden prompts once read by Gemini.
Because:
- Email scanners saw clean text.
- DLP engines saw internal-only queries.
- Endpoint security saw no executable files.
The vulnerability lived in how the AI interpreted content, not in how the system stored or transmitted it.
3. Exfiltration was camouflaged as normal traffic
Even the data exfiltration path hid inside things like image requests or benign API calls — traffic that already exists in huge volume.
So you get this nasty combination:
- No click.
- No malware.
- No obvious anomaly.
That’s why I’d argue this: if your security stack isn’t AI-aware, it’s already behind.
The Real Lesson: AI Productivity Demands AI Security
GeminiJack isn’t an argument against using AI at work. It’s a warning against using AI without a matching upgrade in how you secure it.
If you’re serious about AI-driven productivity in tools like Google Workspace, Microsoft 365, Notion, or Slack, you need to assume:
Your AI assistant is now one of the most privileged “users” in your organization.
And privileged users need guardrails.
Here’s what that looks like in practice.
1. Treat AI assistants as high-risk identities
AI systems accessing your corporate data should be treated like:
- Senior executives
- Shared service accounts
- Critical automation bots
That means:
- Scope access tightly. Don’t give AI blanket access to all drives, inboxes, or channels if you don’t have to.
- Segment by use case. A customer support bot doesn’t need HR files. A sales assistant doesn’t need source code repos.
- Log everything they touch. You should be able to answer: Which documents did this AI instance read this week? If you can’t, you’re flying blind.
2. Put AI in front of AI: prompt and context inspection
You can’t manually review every prompt, every retrieved document, and every response. That’s exactly where AI-powered security earns its keep.
Well-designed AI security layers can:
- Scan retrieved content for embedded instructions, unusual patterns, or signs of prompt injection.
- Evaluate prompts and responses for sensitive data exposure (salaries, secrets, personal identifiers).
- Block or rewrite dangerous instructions before they reach the core model.
Think of it as a “prompt and context firewall”:
- Outer layer: what the user asked.
- Middle layer (security AI): what content and instructions are actually safe to pass through.
- Inner layer: the main productivity AI (Gemini, ChatGPT, Claude, etc.).
This is exactly the space where smarter teams are now investing: using one AI to protect how another AI thinks and responds.
3. Shift DLP from documents to behavior
Traditional data loss prevention watches documents and destinations.
With AI-heavy workflows, you also need to watch behavioral patterns, such as:
- An AI assistant suddenly pulling large volumes of HR or legal content.
- Frequent queries combining sensitive keywords: “salary,” “layoffs,” “acquisition,” “M&A,” “board minutes.”
- Responses that contain more sensitive detail than the user is normally allowed to see.
Here again, AI is better than humans at spotting this at scale:
- It can baseline what “normal” looks like for each team or assistant.
- It can flag outliers and enforce policies in real time.
The result is security that doesn’t slow work down, but silently keeps an eye on what your AI is doing with your data.
How to Protect Your Workspace AI Right Now
You don’t need a full-blown AI security program tomorrow morning, but you can start tightening your environment this week.
Here’s a pragmatic checklist I’d use with any team rolling out Gemini, Copilot, or similar tools.
1. Audit your AI integrations
Map where AI touches your daily work and productivity today:
- Which tools have built-in AI (Docs, Sheets, Slides, Gmail, Calendar, Drive, chat, CRM, helpdesk)?
- Where can these assistants read data (shared drives, personal drives, shared mailboxes)?
- Where can they take action (send emails, create docs, post messages)?
You can’t secure what you haven’t actually mapped.
2. Tighten access and sharing hygiene
GeminiJack depended on shared content being reachable when Gemini searched.
Reduce that blast radius:
- Clean up over-shared drives and folders.
- Remove “Anyone with the link” where it isn’t truly needed.
- Separate highly sensitive spaces (board materials, acquisition docs, HR investigations) into clearly marked, tightly controlled areas.
Less unnecessary sharing means fewer places an attacker can plant “poisoned” files.
3. Set clear internal policies for AI use
Policies don’t stop attacks by themselves, but they:
- Reduce reckless behavior.
- Make monitoring easier because you know what “good” looks like.
Define simple rules like:
- Which kinds of data must not be summarized or processed by AI.
- Which teams can use AI for external-facing content.
- When human review is mandatory before sending AI-generated outputs to clients or partners.
Then bake these expectations into onboarding, training, and your risk register.
4. Start piloting AI-aware security tools
Look for tools or platforms that explicitly support:
- Prompt injection detection.
- Context sanitization or “input washing.”
- AI-specific DLP and anomaly detection.
If you don’t have budget yet, at least start with:
- Logging AI usage where possible.
- Reviewing unusual queries and access patterns monthly.
- Running red-team style tests: plant your own “malicious” instructions in test docs and see how your AI behaves.
You want to discover your GeminiJack-style gaps yourself, not through a headline.
Work Smarter, Not Harder — But Also Not Blind
The whole point of the AI & Technology movement is simple: use AI at work to do more with less effort. Gemini, Copilot, and similar tools really can save you hours every week.
But GeminiJack proves something uncomfortable: productivity AI without AI security is just accelerating your risk.
The good news is the fix isn’t to pull the plug on AI. It’s to:
- Treat AI systems as powerful, privileged actors.
- Put another layer of AI in charge of watching what they see and do.
- Design workflows where speed and safety are both first-class requirements.
As we move into 2026, the organizations that win won’t be the ones who simply add more AI. They’ll be the ones who pair every new AI assistant with an equally smart guardrail.
So ask yourself: If your primary AI assistant started behaving like an insider threat tomorrow, would you notice?
If the honest answer is “probably not,” that’s your roadmap for the next quarter.