Aug 13, 2025Single source
Google Jules asynchronous coding agent vulnerable to multiple data exfiltration issues
AI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
Johann Rehberger disclosed that Google Jules, Google's asynchronous coding agent, was vulnerable to multiple data exfiltration issues. Jules operates as a main agent that proposes a plan and then hands subtasks off to worker agents carrying different tools, and its system prompt and tooling could be steered via prompt injection to pull data off the developer's machine — an instance of the 'lethal trifecta' of agent risks. Findings were shared with Google before publication.
What this means for youIf you use AI coding agents that can read your project files, a hidden instruction in a web page or code comment could trick them into sending data out. At work, teams using these tools should limit what the agent can access and review what it sends.
Sources
- Embrace The Red (Johann Rehberger)https://embracethered.com/blog/posts/2025/google-jules-vulnerable-to-data-exfiltration-issues/
Incident records from the AI Agent Incident Database by sipi.bot (https://sipi.bot/incidents/), licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
Source data license: CC BY 4.0. Attribution to sipi.bot is required.
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2358. It has not been edited since it was approved; the hash above would not match if it had. How to verify