Read Between The Logs: A New Vulnerability in Gemini Cloud Assist Proves the Threat is Real

Read Between The Logs: A New Vulnerability in Gemini Cloud Assist Proves the Threat is Real

Speakers: Liv Matan

Conference: fwd:cloudsec North America 2025

YouTube: https://www.youtube.com/watch?v=BdACXlRMdEA

Overview

Liv Matan, a cloud vulnerability researcher on the Tenable Cloud Security Research Team, presented the discovery of a new attack class: log poisoning to prompt injection targeting cloud-integrated AI assistants. By injecting prompt injection payloads into HTTP request headers (specifically the User-Agent header), an attacker can poison the logs of a victim's cloud environment. When a defender then uses Gemini Cloud Assist to analyze those logs via GCP's "Explain this log entry" feature, the poisoned logs are passed to Gemini as part of an automated prompt, triggering the injection. The vulnerability was reported to Google and fixed, but the underlying attack class -- using cloud logs as a delivery mechanism for prompt injection against AI-powered analysis tools -- represents a persistent and expanding threat surface.

Background

▶ Watch: Teaser: clicking Explain this log entry compromises Gemini Cloud Assist (1:00)

Gemini Cloud Assist is Google's integration of its Gemini AI into the Google Cloud Platform console. It helps users write GCloud CLI commands, analyze cloud resources, and summarize log entries. The AI summarization feature in GCP's Log Explorer allows users to click an "Explain this log entry" button, which generates an automated prompt containing the full log entry and sends it to Gemini for analysis.

Prompt injection is a well-documented attack class where malicious instructions are embedded in data that an LLM processes, causing the model to follow the attacker's instructions instead of the original prompt. The innovation in Matan's research is the delivery mechanism: rather than relying on traditional vectors like emails or documents, the attack uses cloud service logs -- artifacts that are typically considered passive, trustworthy data -- as the injection point. This represents the new era of log poisoning, analogous to the classic PHP log poisoning technique but targeting AI systems instead of web application interpreters.

Key Findings

▶ Watch: Prompt injection hidden by UI design: full prompt only visible on click (6:00)

The vulnerability works because Gemini Cloud Assist ingests full log entries as part of its analysis prompts, and those log entries contain attacker-controllable fields. The User-Agent header in HTTP requests to public cloud functions is logged verbatim and can contain arbitrary content, including prompt injection payloads.

The attack is stealthy by default because the GCP UI design does not show the full prompt to the user. The prompt injection payload is hidden within the log entry and only visible if the user clicks "Additional prompt details" -- an action most users would not take.

Matan also injected special characters designed to break out of the JSON context within the prompt. Since the full prompt contains both system instructions and the JSON log entry, these characters force Gemini to interpret the injected text as literal instructions rather than as part of a JSON string.

The blast radius extends far beyond cloud functions. Any GCP public network service that generates logs from external requests is affected, including App Engine, Cloud Run, Cloud Load Balancing, and more. An attacker could spray prompt injections across all public-facing GCP services, creating a wide net for potential victims.

Matan discovered that Gemini Cloud Assist has capabilities to call certain Google Cloud APIs, including the Cloud Asset API for querying and reading cloud resources. This means a successful prompt injection could instruct Gemini to read cloud resources and exfiltrate data to an attacker-controlled server via a rendered link.

Google fixed the vulnerability by disabling link rendering in Gemini Cloud Assist responses. This eliminates the primary data exfiltration vector (clickable links that send data to attacker servers) and prevents phishing attacks through rendered links. Images were also disabled as a rendering vector.

Technical Deep Dive

▶ Watch: Blast radius: all GCP public network services affected (8:30)

The attack chain proceeds through several stages:

Step 1 -- Log Poisoning: The attacker sends an HTTP request to a victim's public cloud function with a prompt injection payload in the User-Agent header. The payload instructs Gemini to render a link to an attacker-controlled domain (e.g., attacker.com) and includes special characters to escape the JSON context.

Step 2 -- Prompt Generation: When a victim clicks "Explain this log entry" in GCP Log Explorer, an automated prompt is generated containing both Gemini's system instructions and the full log entry (including the injected User-Agent header). The injection payload is not visible in the default UI view.

Step 3 -- JSON Context Escape: The special characters injected alongside the payload break out of the JSON string context within the prompt, forcing Gemini to interpret the attacker's text as top-level instructions rather than as log entry content.

Step 4 -- Payload Execution: Gemini follows the injected instructions, rendering a phishing link disguised as "Click here for more details." If the victim clicks the link, they are directed to an attacker-controlled server where credentials can be harvested.

Step 5 -- Data Exfiltration (pre-fix): Because Gemini Cloud Assist has access to the Cloud Asset API, the injected prompt could instruct Gemini to query cloud resources and include the results in the exfiltration URL parameters, sending the data to the attacker's server when the victim clicks the link.

Matan also investigated Azure Copilot, the equivalent service in Azure. Initial attempts to get Copilot to render links failed across hundreds of prompts. However, by exploiting Copilot's handler system -- which routes questions to specialized handlers with parameters like "user intent" -- Matan crafted a prompt that combined a legitimate question (to match an AKS handler) with a link rendering request (interpreted as the user intent parameter). This bypassed Copilot's link rendering restrictions, though Azure Copilot was not mature enough at the time to ingest and read log text content, so the full attack chain was not achievable.

Demo / Proof of Concept

▶ Watch: Google's fix: disabling link rendering in Gemini Cloud Assist (10:00)

Matan presented a PoC demonstration showing the complete attack flow: sending the malicious HTTP request with the prompt injection to a public cloud function, the log appearing in GCP Log Explorer, the victim clicking "Explain this log entry," the automated prompt being sent to Gemini with the hidden injection, and Gemini returning a response containing a phishing link. The demo also showed the prompt injection detection query in action in GCP Log Explorer, successfully identifying the injected User-Agent header.

Defensive Implications

▶ Watch: Detection query for prompt injection patterns in GCP Log Explorer (13:00)

Defenders should implement monitoring for prompt injection patterns in cloud service logs, particularly in HTTP headers. Matan provided an example GCP Log Explorer detection query that targets the User-Agent header and searches for keywords commonly associated with prompt injections: "instruction," "print," "markdown," and model-specific terms like "Gemini."

Organizations should recognize that cloud logs are no longer passive artifacts -- in an era where AI tools ingest and process logs, any attacker-controllable field in a log entry becomes a potential prompt injection vector. The trust boundary between log data and AI analysis tools needs to be explicitly acknowledged and secured.

The fix Google implemented -- disabling link and image rendering in Gemini Cloud Assist -- is a pragmatic mitigation but not a fundamental solution to the prompt injection problem. As cloud AI assistants gain additional capabilities (particularly write access to cloud resources), the risk from this attack class will escalate significantly. Organizations should advocate for cloud providers to maintain strict capability boundaries on AI assistants and monitor for feature expansions that could reintroduce attack vectors.

Key Takeaways

• Cloud logs are a viable delivery mechanism for prompt injection attacks against AI-powered analysis tools like Gemini Cloud Assist
• The attack is stealthy by default: the full prompt (containing the injection) is hidden behind an "Additional details" click in the GCP UI
• Any GCP public network service that logs HTTP headers is a potential injection point, creating a broad spray-and-pray attack surface
• Gemini Cloud Assist's access to the Cloud Asset API enables data exfiltration via prompt injection, extending impact beyond phishing
• Google fixed the specific vulnerability by disabling link and image rendering, but the underlying prompt injection risk persists
• Azure Copilot's handler system can be exploited to bypass link rendering restrictions, though the full attack chain was not achievable at the time of research

About the Speaker(s)

Liv Matan is a cloud vulnerability researcher on the Tenable Cloud Security Research Team. His research focuses on discovering vulnerabilities in cloud-integrated AI services. Outside of security research, he is interested in dogs and electronic music.