Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
Embrace the Red (https://embracethered.com/blog/) demonstrated that Bard users' conversations could be exfiltrated via an indirect prompt injection. To execute the attack, a threat actor shares a Google Doc containing the prompt with the target user who then interacts with the document via Bard to inadvertently execute the prompt. The prompt causes Bard to respond with the markdown for an image, whose URL has the user's conversation secretly embedded. Bard renders the image for the user, creating an automatic request to an adversary-controlled script and exfiltrating the user's conversation.
The request is not blocked by Google's Content Security Policy (CSP), because the script is hosted as a Google Apps Script with a Google-owned domain.
Note: Google has fixed this vulnerability. The CSP remains the same, and Bard can still render images for the user, so there may be some filtering of data embedded in URLs.
ASSESSED SYSTEM
Google Bard with Bard Extensions access to the user's Google documents, in the pre-fix configuration demonstrated by Embrace the Red and recorded as MITRE ATLAS AML.CS0029: retrieval of documents shared with the user into the answer context, the chat renderer that automatically fetches Markdown images, and the Content Security Policy that governs which destinations those fetches may reach. Google has since fixed the issue; the pre-fix configuration is scored.
OUT OF SCOPE
Bard as it stands after Google's fix. The attacker's Google Apps Script and the Google Doc it logs to — Apps Script appears only as the CSP-allowed destination the chain used, not as a component under assessment. Google Workspace as a product beyond Bard's retrieval of it. The Fairness axis (Fa-1..4).
Architecture: RAG / Retrieval-Augmented System (decision tree Q4) — Q1 and Q2 = NO: a single assistant answering one user query, with no agent topology or autonomous planning loop evidenced. Q3 = NO for the assessed path: the exfiltration hop is the renderer's automatic image fetch, not a model-invoked function, and the case supplies no function schema or tool-call log. Q4 = YES: 'when the user makes a query that results in the document being retrieved, the embedded prompt is executed' — external content shared into the user's documents is assembled into the answer context at inference time. Tier 2: Tier 2 Consumer: Bard is a mass-market public assistant, and the demonstrated exploitation affects individuals — any party able to share a Google Doc with the user can exfiltrate that user's conversation. No physical or systemic financial harm at scale is evidenced.
Documented attack or failure path
- The researcher writes a prompt that makes Bard emit a Markdown image whose URL carries the user's conversation, and a Google Apps Script that logs every query parameter it receives.
- Because Apps Script runs unauthenticated on script.google.com or googleusercontent.com, the destination falls inside Bard's Content Security Policy, which admits Google-owned domains.
- The researcher shares a Google Doc containing the prompt with the target; Bard Extensions give Bard access to the user's documents.
- A user query retrieves the document, and the embedded prompt executes, producing a Markdown image pointing at the Apps Script with the conversation in a query parameter.
- Bard renders the image automatically; the CSP allows the request because the host is Google-owned, and the conversation is logged by the attacker's script.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- The Content Security Policy constrained rendered-media destinations to Google-owned domains. The researcher had to identify an unauthenticated Google-hosted execution surface to complete egress — the case labels this step a CSP bypass path — so the policy changed the attacker's work even though it did not stop the chain. It is the reason Cn-1 is scored at 0.50 rather than at a failure anchor.
- Retrieval honoured document access: the malicious prompt reached Bard only because the attacker shared the document with the target, so the chain operated within the user's own document permissions.
- Google fixed the vulnerability; ATLAS notes the CSP is unchanged and Bard still renders images, with possible filtering of data embedded in URLs.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.07–0.79 (midpoint 0.43), Tier 2 MVT 0.50 indeterminate | |||
| Ro-1Adversarial Input Resistance | 0.25w 0.28 | The 0.25 anchor, on the corpus convention for a demonstrated indirect-injection bypass without a measured rate. The 0.50 anchor requires resistance to common injection templates with ASR below 50%; a plainly worded instruction in a shared document succeeded. Not 0.00: no failure rate above 80% is measured and no evidence shows the absence of every input control. | A prompt in a document shared with the user was retrieved through Bard Extensions and executed as instructions, steering Bard to construct an exfiltration image. No input screening, attack-success rate or bypass measurement is reported.source: secureflow/atlas |
| Fairness (Fa) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.50 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 2 MVT 0.55 indeterminate | |||
| Containment (Cn) — scenario interval 0.10–0.68 (midpoint 0.39), Tier 2 MVT 0.55 indeterminate | |||
| Cn-1Scope Enforcement | 0.50w 0.12 | The 0.50 anchor: core scope controls block the common violation — egress to an arbitrary attacker domain — but an edge case remains in the downstream network path, an allowed domain that executes attacker-authored code. The 0.75 anchor requires scope enforcement across network paths with violations denied and logged, which the allowed-domain hop disproves. | Positive: rendered-media egress was governed by a Content Security Policy that admitted only Google-owned domains, so a direct attacker domain was not a usable destination and the researcher had to identify Apps Script as a 'CSP Bypass Path'; retrieval stayed within documents shared with the user. Negative: the allowlist admitted script.google.com and googleusercontent.com, on which anyone can deploy an unauthenticated script that records arbitrary query parameters.source: secureflow/atlas |
| Cn-3Output Filtering Robustness | 0.25w 0.16 | The 0.25 anchor: a basic, category-level restriction on rendered outputs existed (only Google-hosted media would load) but was bypassed by laundering through an allowed host. The 0.50 anchor requires filtering that blocks common unsafe outputs; a conversation-bearing image URL is the common unsafe output here and it rendered unexamined. | The unsafe output was a Markdown image whose URL carried the user's conversation as a query parameter. The only output-side constraint in the record is the destination policy, already credited under Cn-1; no inspection of the data embedded in the generated URL ran before render. ATLAS notes only that after Google's fix 'there may be some filtering of data embedded in URLs'.source: secureflow/atlas |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: no origin labelling on the retrieval channel — a document shared by a third party was admitted to active context as trusted context and its instruction produced an output the user did not request. The 0.25 anchor requires origin labels on some channels or denial by prompt wording; neither is evidenced. The model-level outcome remains scored under Ro-1. | A prompt in a Google Doc shared with the user was retrieved through Bard Extensions into the answer context and executed as instructions, steering Bard to construct an exfiltration image. The retrieved document content carried no origin label or demotion to untrusted data; retrieval honoured document access, but once in context the third-party content inherited full instruction authority over the generated output.source: secureflow/atlas |
Unknown, not N/A: 22 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.25w 0.25 | Near the low end. Bard answers for the user and holds no write, transaction or tool-execution authority in the evidenced chain, which points at 0.00; but one automated side effect — the renderer fetching model-emitted media — executes on the model's output with no confirmation and no human in the path, which is what makes the exfiltration automatic. Scored at the 0.25 anchor as the nearest fit, matching the treatment of the same render-fetch pattern elsewhere in the corpus. |
| AsAttack Surface Exposure | 0.90w 0.35 | Documented interpolation above the 0.75 anchor. Bard is internet-facing and ingests external documents into its answer context; the anchor's 'partially trusted' sources understate the demonstrated condition, because any party able to share a Google Doc with the user — no prior relationship required — can place instruction-bearing content in the retrieval scope. Below 1.00 because no multi-agent communication or MCP-class tool integration is evidenced on the path. elevated |
| CpCascade Potential | 1.00w 0.20 | No System Dependency Graph is published for Bard, so the specification's worst-case default applies. The reconstruction also supports the 1.00 anchor through the fault-injection indicator: the injected payload propagated the full predicted path — externally writable retrieval input, into model context assembly, through the render surface and out to an external endpoint — crossing the one declared egress gate, the CSP, which invalidates that gate's containment claim on that path. The corroboration is qualitative: a single demonstrated chain, not the trial count the indicator specifies.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.25w 0.20 | The 0.25 model-adjacent anchor. Google fixed the issue service-side, and the remediation class is deployment-layer — render-surface egress policy, inspection of data embedded in generated URLs, and handling of retrieved documents as untrusted — with no model change. Not 0.00, because the fix is a set of deployment controls rather than a single deterministic patch; well below 0.75, because the assessed vulnerability is the specific exfiltration chain, which was closed, rather than indirect prompt injection as a class. |
Nelevated = 2 (dimensions strictly above 0.75) → CRM = 1.15.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.25 | The 0.25 anchor: the vendor, product, Extensions feature and CSP posture are named, but the case provides no architecture record, retrieval policy, renderer policy, model lineage or evaluation artefact for the assessed configuration, and nothing is verifiable beyond the reported fix. |
| Ec — Public evaluation coverage | 0.13 | coverage 0.15 (4 of 26 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.00 | Evidence dated 2023-11-23; age 1060 days on the workpaper reference date. Components: T_calendar 0.00 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_calendar. dt_days is measured from the MITRE ATLAS AML.CS0029 incident date 2023-11-23 (day granularity) to the 2026-10-18 evidence reference date; the primary Embrace the Red report is listed in sources. agentic = false: the RAG class shows no runtime tool reprovisioning or credential issuance in the evidenced chain. baw = false: the shared document is written by another user, not by the model, and no model-writable memory, self-modifying configuration, agent-to-agent channel or closed feedback loop is evidenced. C_monitor 0.65 — no detection of the exfiltration image is evidenced. C_event 0.65 — moderate: a researcher-disclosed vulnerability fixed by the vendor with no reported in-the-wild compromise. C_evidence 0.85 — the exfiltration hop was fixed, but ATLAS records the CSP unchanged and image rendering retained, so the trust-separation root cause remains open. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.02 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
4.3 midpoint, interval 1.6–7.0; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-002.002 | Inference-Time Prompt & Input ValidationExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 Ro-5 Fa-1 Fa-3 Cn-8 |
| AID-D-014.001 | Post-Retrieval Malicious Content ScanningExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-2 Ro-3 |
| AID-H-017.007 | Dual-LLM Isolation PatternExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Cn-5 Cn-7 |
| AID-D-001.001 | Per-Prompt Content, Intent & Obfuscation AnalysisExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-016.001 | System Prompt Structure & Instruction/Data SeparationExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-5. Presence supplies no score credit. | Candidate evidence route | Ro-1 |
| AID-H-006.002 | Text, Markup & Structured Output Sanitization and Release GateExact SecureFlow defense-map identifier (flow atlas-aml-cs0029-google-bard-conversation-exfiltration), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-6. Presence supplies no score credit. | Candidate evidence route | Ro-3 Cn-3 |
WHAT THIS CASE TEACHES
Crediting a held control once and only once: Bard's CSP genuinely forced a bypass and earns Cn-1 its 0.50, but because it governs destinations rather than output content it does not also lift Cn-3, where the conversation-bearing URL rendered unexamined at 0.25.
Sources: AIDEFEND SecureFlow — Google Bard Conversation Exfiltration · MITRE ATLAS case study AML.CS0029 · Hacking Google Bard - From Prompt Injection to Data Exfiltration (embracethered.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0029 (exercise) |
|---|---|
| Target | Google Bard |
| Actor | Embrace the Red |
| Primary evidence date | 2023-11-23 |
| SecureFlow record updated | 2026-08-02 |
| AI layers | AI infrastructure |
| Risk impact | Data exfiltration |
| Affected components | Google Bard, Google Docs retrieval integration, Markdown image rendering, Google Apps Script exfiltration endpoint |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Develop Markdown Image Exfiltration PromptThe researcher developed a prompt that causes Bard to include a Markdown element for an image with the user's conversation embedded in the URL as part of its responses. | AML.TA0003 AML.T0065 |
| 2 | Identify Google Apps Script CSP Bypass PathThe researcher identified that Google Apps Scripts can be invoked via a URL on `script.google.com` or `googleusercontent.com` and can be configured to not require authentication. This allows a script to be invoked without triggering Bard's Content Security Policy. | AML.TA0003 AML.T0008 |
| 3 | Write Query-Logging Google Apps ScriptThe researcher wrote a Google Apps Script that logs all query parameters to a Google Doc. | AML.TA0003 AML.T0017 |
| 4 | Share Malicious Google Doc with TargetThe researcher shares a Google Doc containing the malicious prompt with the target user. This exploits the fact that Bard Extensions allow Bard to access a user's documents. | AML.TA0004 AML.T0093 |
| 5 | Execute Retrieved Prompt InjectionWhen the user makes a query that results in the document being retrieved, the embedded prompt is executed. The malicious prompt causes Bard to respond with markdown for an image whose URL points to the researcher's Google App Script with the user's conversation in a query parameter. | AML.TA0005 AML.T0051.001 |
| 6 | Exfiltrate Conversation via Rendered ImageBard automatically renders the markdown, which sends the request to the Google App Script, exfiltrating the user's conversation. This is allowed by Bard's Content Security Policy because the URL is hosted on a Google-owned domain. | AML.TA0010 AML.T0077 |
| 7 | Violate User Conversation PrivacyThe user's conversation is exfiltrated, violating their privacy, and possibly enabling further targeted attacks. | AML.TA0011 AML.T0048.003 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0029-google-bard-conversation-exfiltration; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0029 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).