{
 "id": "AIR-2025-0053",
 "slug": "google-bard-conversation-exfiltration-via-indirect-prompt-in",
 "title": "Google Bard Conversation Exfiltration via Indirect Prompt Injection",
 "summary": "Researchers demonstrated an indirect prompt injection attack against Google Bard that exfiltrated user conversations. Malicious documents shared with users forced Bard to render an image containing embedded conversation data sent to an attacker server.",
 "type": "attack_on_ai",
 "categories": [
  "prompt_injection",
  "data_leak"
 ],
 "severity": 1,
 "targets": [
  "Google"
 ],
 "products": [
  "Google Bard"
 ],
 "incident_date": "2023-11-23",
 "incident_date_precision": "day",
 "first_reported": "2025-04-22",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0029",
   "publisher": "MITRE ATLAS",
   "title": "Google Bard Conversation Exfiltration",
   "published_at": "2025-04-22"
  },
  {
   "url": "https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration",
   "publisher": "Embrace The Red",
   "title": "Hacking Google Bard - From Prompt Injection to Data Exfiltration",
   "published_at": "2025-04-22"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "indirect-prompt-injection",
  "data-exfiltration",
  "bard"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}