Weaponizing image scaling against production AI systems
Summary: Trail of Bits researchers achieved data exfiltration on production AI systems including Google Gemini CLI, Vertex AI Studio, Gemini's web and API interfaces, Google Assistant, and Genspark by embedding prompt injections in images that are invisible at full resolution but emerge when the system downscales them. The Gemini CLI exploit used the default Zapier MCP server configuration, which sets trust=True and auto-approves tool calls, letting a benign-looking uploaded image trigger exfiltration of Google Calendar data to an attacker's email without confirmation.
What's compelling: The attack works because users see one image and the model sees another, and on Vertex AI Studio the UI displays the high-resolution version rather than the downscaled input the model actually processes. A default MCP setting that auto-approves tool calls turned a single uploaded image into silent exfiltration of calendar data, with no confirmation prompt shown.
Read the original at Trail of Bits Blog ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026