1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Gemini Agent presents a trifecta-complete risk shape where untrusted web content, sensitive Connected Apps data, and unrestricted browser egress converge in a single reasoning loop on the default configuration.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Gemini Agent requires operator hardening before deployment, constrained primarily by a wide configuration-penalized attack surface against contained cloud-hosted blast.
Gemini Agent sits in the Fortified Leaders quadrant with attack surface 5.90, blast radius 5.50, and defense controls 9, meaning broad input exposure pairs with contained execution scope and operators should prioritize reducing input channels before hardening blast containment.
Each axis measures a distinct dimension: attack surface and blast radius score against a ceiling of 10, defense controls against 15, and AIRQ composites them.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 6.35 | Moderate resilience indicates operator hardening is required to reduce the trifecta-driven attack surface before the agent reaches acceptable residual risk. |
| Blast Radius | 5.5 / 10 | Network and credential access via Connected Apps OAuth scopes drive the blast score; cloud sandbox and approval gates contain code execution and deployment. |
| Attack Surface | 5.9 / 10 | Configuration penalty from CVE-2026-0628 and multiple unvalidated input channels drive the score; all three trifecta dimensions are triggered. |
| Defense Controls | 9 / 15 | Four vendor-documented controls score at the maximum vendor-evidence tier; monitoring falls short without SIEM or anomaly detection for the consumer product. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The reasoning loop ingests web page content, Connected Apps data, MCP tool responses, and user chat input as first-class attacker-reachable channels on the default configuration.
Higher scores reflect broader unvalidated input reach and demonstrated exploitation; configuration peaks due to a patched CVE with CVSS 8.8.
Each row names one attack surface, its adjusted score against the band ceiling, and an analyst comment citing the agent-specific evidence.
| Surface | Score | Comments |
|---|---|---|
| User Input | 4 / 4 | Multiple input channels including web content, calendar invites, and MCP responses with ML-based filtering but no instruction hierarchy separation; independent research demonstrated indirect injection via calendar invites. [4] |
| External Data | 3 / 4 | Ingests content from arbitrary websites, Gmail messages, Calendar events from third parties, and Drive files through Connected Apps with User Alignment Critic scanning. [1] |
| Memory | 2 / 4 | Remote browser cookies and authentication info persist across sessions with user-deletable storage; no automated learning loops or cross-session skill codification documented. [7] |
| Reasoning | 2 / 4 | Multi-step reasoning with User Alignment Critic operating as a separate model invocation that evaluates actions independently of the untrusted context window. [5] |
| Planning | 3 / 4 | Gemini Spark enables autonomous background task execution with scheduled actions; personal tasks run without approval while actions involving others require review. [9] |
| Tool Execution | 3 / 4 | Remote browser evaluates JavaScript, fills forms, and navigates pages with Connected Apps providing access to Drive, Gmail, and Calendar; confirmations required for sensitive actions. [5] |
| Orchestration | 3 / 4 | Gemini Spark runs as a background daemon with Deep Research spawning parallel sub-tasks, scheduled executions, and custom sub-agent delegation via MCP; CLI headless mode carried an RCE via workspace trust bypass. [2][9] |
| Inter-Agent | 3 / 4 | Connects to external MCP servers with expanding third-party integration; no documented inter-agent authentication or message integrity verification for MCP responses. [9] |
| Output Processing | 2 / 4 | Markdown sanitization blocks image-URL exfiltration and Safe Browsing redacts suspicious URLs; vendor documents this as preventing EchoLeak-style attacks. [6] |
| Configuration | 4 / 4 | Connected Apps and MCP connections configured through user settings; CVE-2026-0628 (CVSS 8.8) demonstrated Chrome extension hijacking of the Gemini panel via declarativeNetRequests API reaching local files and camera. [1][3] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Gemini Agent processes untrusted web content through its remote browser, holds user-consented Connected Apps tokens granting read-write reach into Gmail, Calendar, and Drive, and transmits data through unrestricted browser navigation and email sending.
Gemini Agent exhibits all three of these conditions in its documented default configuration:
- Untrusted input — The remote browser ingests arbitrary HTML and JavaScript from any site, and Connected Apps pull calendar invites authored by third parties into the reasoning loop. [4]
- Sensitive data — Connected Apps grant OAuth-scoped access to Gmail inbox, Calendar events, Drive files, and Google Photos; remote browser sessions store cookies containing authentication credentials. [7]
- External egress — The remote browser navigates arbitrary URLs, the agent sends emails and calendar events, controls smart home devices, and invokes third-party MCP services. [9]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised reasoning loop reaches OAuth-scoped Connected Apps data and autonomous scheduled actions but cannot reach production infrastructure, deployment pipelines, or package registries.
Higher blast scores reflect broader reach from a compromised session; network and credentials peak due to unrestricted browser outbound and stored OAuth tokens.
Each row maps a blast factor to the scope a compromised agent session can reach through the documented default tool grants and OAuth integrations.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 2 / 4 | Remote browser evaluates JavaScript in a cloud-hosted sandbox isolated from the user's local machine; Connected Apps access scoped to OAuth grants without arbitrary shell execution. [5] |
| File system access | 2 / 4 | Read-write access scoped to Connected Apps grants including Drive files and Gmail attachments; no direct local file system access under default operation. [7] |
| Network access | 3 / 4 | Remote browser navigates arbitrary URLs with filtered but bypassable outbound; Safe Browsing blocks known-malicious destinations but cannot prevent data submission to attacker-controlled domains. [5] |
| Credential access | 3 / 4 | OAuth-scoped access to Gmail, Calendar, and Drive via Connected Apps; remote browser stores cookies and authentication info across sessions. [7] |
| Autonomous action | 2 / 4 | Gemini Spark enables scheduled autonomous execution for personal tasks such as sending messages and device control; multi-party actions require review before firing. [8] |
| Deployment access | 1 / 4 | Consumer-oriented agent with no documented deployment, infrastructure modification, or package publishing capabilities; limited to user-facing productivity tasks. [8] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor documents four controls at the ML-detection and cloud-isolation tier by default, but monitoring remains limited to basic activity visibility without alerting or SIEM integration.
Higher defense scores reflect stronger vendor-implemented safeguards; the inverted color scale marks gaps where operator-managed controls are required.
Each component is scored on vendor-implemented default-on controls, capped at the evidence tier available for independent verification.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 2 / 3 | User Alignment Critic provides ML-based injection detection as a separate model isolated from untrusted content; Safe Browsing filters known-bad URLs; vendor-documented without independent adversarial validation published. [6] |
| Execution Isolation | 2 / 3 | Remote browser runs in Google cloud infrastructure with Agent Origin Sets restricting accessible origins per task; meaningful access scoping documented. [5] |
| Action Controls | 2 / 3 | User confirmations required for sensitive actions including form fills, script evaluation, and purchases; CLI adds hard blocks for file uploads to browser sessions. [8][10] |
| Output Guardrails | 2 / 3 | Markdown sanitization blocks image-URL exfiltration; suspicious URL redaction via Safe Browsing; credential display warnings for sensitive output. [6] |
| Monitoring | 1 / 3 | Privacy Dashboard provides activity visibility; no SIEM forwarding, behavioral anomaly detection, or automated alerting documented for the consumer tier. [7] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize breaking the trifecta by restricting which Connected Apps data enters agent sessions and gating autonomous Gemini Spark executions.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require secondary approval for any agent action triggered by content from external senders, reducing the user-input attack surface by blocking indirect injection from calendar invites and forwarded emails.
- Configuration Disable Connected Apps integrations not actively needed to reduce the number of untrusted external data sources feeding the reasoning loop.
- Engineering Deploy a proxy-layer content classifier between Connected Apps and the agent to flag injection patterns in calendar event titles before processing.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Restrict Agent Origin Sets to an explicit domain allowlist required for each workflow rather than relying on the default task-scoped set.
- Configuration Configure enterprise-tier remote browser data policies to clear cookies and authentication info after each session rather than persisting.
- Engineering Instrument the remote browser session boundary to log all JavaScript evaluation requests and form submissions for forensic review.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require approval for all scheduled Gemini Spark actions regardless of whether they involve other people to close the autonomous personal-task gap.
- Configuration Disable MCP connections to third-party servers that have not completed the vendor four-step evaluation process.
- Engineering Implement a time-boxed session limit for background Gemini Spark executions, reducing autonomous-action blast radius by capping the window for unreviewed operations.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Block outbound email sending from agent-initiated actions unless the recipient is on an operator-maintained allowlist.
- Configuration Restrict smart home device actuation to a named device allowlist to prevent the agent from controlling unintended devices.
- Engineering Deploy an egress content inspection layer that flags agent-generated outbound traffic containing patterns matching sensitive Connected Apps data.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Forward Privacy Dashboard activity logs to an enterprise SIEM to enable correlation of agent actions with other security events.
- Configuration Configure alerting on Gemini Spark background executions that exceed a defined duration or action-count threshold.
- Engineering Instrument audit logging for all MCP tool invocations with request-response pairs, enabling anomaly detection baselines and lateral movement pattern matching across integration boundaries.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2026-0628 NVD CVE 8.8 — Chrome Gemini panel privilege escalation via extension hijacking, patched Jan 2026
- GHSA-wpqr-6v78-jr5g CVSS 10.0 — Gemini CLI RCE via workspace trust bypass in headless mode, patched Apr 2026
Selected Research
- Unit 42 Gemini Panel Hijacking Evidences the configuration penalty: demonstrates real-world extension hijacking reaching local files and camera through the Gemini panel
- SafeBreach Gemini Prompt Injection Evidences the trifecta input dimension: demonstrates indirect prompt injection via calendar invites triggering unauthorized agent actions
Vendor Documentation
- Architecting Security for Agentic Capabilities Evidences execution isolation and reasoning controls: documents User Alignment Critic as a separate model and Agent Origin Sets as domain scoping
- Mitigating Prompt Injection Attacks Evidences output guardrails: documents markdown sanitization blocking image-URL exfiltration and Safe Browsing URL redaction
- Gemini Apps Privacy Hub Evidences data retention and credential scope: documents remote browser cookie handling and Connected Apps OAuth data sharing boundaries
- Gemini Agent Help Page Evidences action controls: documents user supervision gates, planning display, and take-control option for autonomous actions
Other Sources
- Gemini App Next Evolution Announcement Gemini Spark 24/7 agent and MCP connections to third-party servers announced
- Gemini CLI Sensitive Action Controls PR adding sensitive action controls and hard blocks for file uploads to browser agent