2026-07-07 · 2026-Q3
Google Gemini Live API RCE via Unconstrained Ephemeral Tokens
Who actually said "do this"?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
Browser-based applications using the Gemini Live API for voice sessions
Impact
Misconfigured ephemeral tokens let a client override the system prompt and tool definitions and trigger code execution; a proof of concept ran `os.uname()` and returned a nonce-based SHA-256 to prove genuine execution. The weakness traces back to Google's own reference implementation
Root cause
Every setup-frame field is optional, so any parameter not locked server-side (via `live_connect_constraints`) stays client-controllable. Reported by researcher Alvin Ferdiansyah
Sources
Catalog
Cite this: AgentProv incident record: Google Gemini Live API RCE via Unconstrained Ephemeral Tokens (2026-07-07). https://agentprov.com/incidents/2026-07-07-google-gemini-live-api-rce-via-unconstrained-ephemeral-tokens
Related
- Also L2 · 2026-10-15Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block ThresholdL2Instruction
- Also L2 · 2026-10-08Cisco Talos: Four Malware Families Carry Instructions Aimed at the LLMs That Triage ThemL2Instruction
- Also L2 · 2026-10-07Barracuda: Phishing Emails Carry Hidden Prompt Injections for the Recipient's AI Inbox AssistantL2Instruction