Gemini Trifecta. The access path.
A User-Agent header became an instruction Gemini followed inside a GCP project. The attacker never authenticated. The entry point was a field the victim's own systems wrote.
The record
Entry point. public facing GCP service, prompt text placed in an HTTP User-Agent header.
The identity in the middle. None stolen. The asset abused is Gemini's own authorised read access to Cloud Asset, Cloud Monitoring and Recommender APIs in the victim's project, plus the user's saved personalisation data.
What was reached. saved user data and location, returned through an attacker authored link, or through the browsing tool with nothing shown in the interface.
A User-Agent header became an instruction Gemini followed inside a GCP project.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| public facing GCP service | Entry | prompt text placed in an HTTP User-Agent header |
| Cloud Logging entry | Step | the header is stored as a normal log line |
| Gemini Cloud Assist | Step | the user asks for a log summary and the injected text is treated as instructions |
| integrated cloud APIs | Step | Gemini can query cloud resources through its own read integrations |
| saved user data and location | Reached | returned through an attacker authored link, or through the browsing tool with nothing shown in the interface |
Where a breakpoint would have been
Treating ingested data as data. All three paths start with content the victim's own infrastructure recorded, so no gate stands between the attacker and the model. The usable control sits on the other end: what the assistant may fetch, and where its output may point.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Questions, answered.
The two questions this record answers.
What was the entry point in the Gemini Trifecta incident?
The published path starts at public facing GCP service, prompt text placed in an HTTP User-Agent header.
What did it reach?
The last step in the published path is saved user data and location, returned through an attacker authored link, or through the browsing tool with nothing shown in the interface.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.