AI risk
Risk type: Tool Risk
Google Gemini security
Gemini security covers two risks. Some chats reach human reviewers and training. Gemini in Chrome can act on pages that hide instructions.
Gemini Apps use a Keep Activity setting. With it on, Google can train models on your chats. Reviewed chats are kept up to 3 years. Work and school accounts follow separate terms. Gemini in Chrome adds agentic browsing. Google calls indirect prompt injection the primary new threat. Turn off Keep Activity for sensitive chats. Confirm sensitive agent steps yourself.
Last updated
2026-10-30
Gemini surfaces, data handling, and controls
| Surface | Data handling | Main risk | Control |
|---|---|---|---|
| Gemini Apps, personal | Keep Activity on: chats can train models. Reviewers read a subset. | Pasted work data reaches review and training. | Turn off Keep Activity. Chats still stay 72 hours. |
| Gemini Apps, Temporary Chats | Kept up to 72 hours. Not used for reviewer-assisted improvement. | Sensitive data still reaches Google. | Use them for one-off questions. |
| Gemini in Google Workspace | No human review or training outside your domain without permission. | Gemini retrieves anything the user can access. | Fix sharing permissions before rollout. |
| Gemini in Chrome auto browse | Acts in Chrome for U.S. AI Pro and Ultra subscribers. | Pages can hide instructions that steer the agent. | Confirm sensitive steps. Watch the work log. |
From Google’s privacy hubs and Chrome security posts. Sources checked October 30, 2026.
Affected tools
- Gemini Apps (personal accounts)
- Gemini in Google Workspace
- Gemini in Chrome
- AI browser extensions
How it usually happens in the browser
- Employees paste documents, customer data, and code into Gemini.
- Users upload spreadsheets and PDFs into the Gemini web app.
- Work chats land in personal accounts with Keep Activity on.
- Auto browse reads a page with hidden instructions.
- The agent acts on sites where you are signed in.
- People follow AI-suggested links to unknown sites.
What traditional defenses miss
- Most controls were not built for prompt boxes.
- Encrypted sessions hide prompt text from most network tools.
- Agent actions run inside the user’s own browser session.
- Unapproved AI sites stay reachable without a browser policy.
Mitigation checklist
- Turn off Keep Activity on accounts used for work.
- Move work use to Gemini in Google Workspace.
- Review Drive sharing before enabling Gemini in Workspace.
- Confirm purchases, messages, and sign-ins during auto browse.
- Allowlist approved AI tools and extensions in Chrome.
- Never enter data you would not show a reviewer.
Where browser isolation fits
- Shield runs the page in a browser that is not on your computer, destroyed when you close the tab.
- Open unfamiliar links from Gemini answers in Shield.
- Isolation does not change what Gemini keeps or reviews.
- Data you paste into Gemini still reaches Google.
Limits
- Google’s terms differ by account type.
- Auto browse is only for some paid subscribers.
- Google’s defenses are its own description, not an audit.
- We reviewed Google documentation and did not test Gemini.
FAQs.
Do humans review Gemini conversations?
Yes, a subset of them. Google says trained reviewers read some chats. It disconnects them from your account first. Reviewed chats are kept up to 3 years.
Does Google use Gemini chats to train its models?
With Keep Activity on, yes. Google uses that activity to improve services and train models. With it off, new chats are not used for training. Feedback you send is an exception. Google still keeps chats up to 72 hours.
Is Gemini in Workspace different?
Yes, Workspace has separate terms. Google says it needs permission for human review. Training outside your domain also needs permission. Gemini only retrieves content the user can access.
Can a website take control of Gemini in Chrome?
A page can try. Google calls indirect prompt injection the primary new threat. A separate model vets each planned action. Origin limits restrict which sites the agent can touch. Sensitive steps need your confirmation.
Can we allow Gemini but block unapproved AI tools?
Yes, through Workspace and Chrome policy. Approve Gemini for work accounts. Then restrict other AI sites and extensions.
References
- 01Gemini Apps Privacy HubGoogle
- 02Generative AI in Google Workspace Privacy HubGoogle Workspace
- 03
- 04
- 05OWASP LLM01:2025 Prompt InjectionOWASP Gen AI Security Project
Keep exploring
- Prompt injection: direct and indirect attacksHow hidden instructions steer an AI agent.
- Claude security: data, browser, and agent risksData handling and browser agent controls for Claude.
- Sensitive data in AI promptsWhat ChatGPT, Claude, and Gemini keep.
- Install the skillAgent builders reach the same routing and isolation through a ready skill.
- All guidesThreats, secure apps, and AI security pages.
- All AI security guidesBrowse AI topics by risk type.
- Secure apps directorySecure browsing guides for top SaaS apps.
- Threat libraryThreat pages with checklists and FAQs.
