The author behind Documentation of Gemini File Leaking Behavior showed consumer Gemini with Workspace Connected Apps pulling Gmail and Drive text into chat without an @Drive or @Gmail tag.
Google says connected email and files can enter human review, with reviewers told what they see "may just be the email or file" and users told "don't connect your apps to Gemini Apps if they contain confidential information that you wouldn't want a reviewer to see," per Help Answer 16836988 and an October 16 edit to its 2023 blog post cited in the repo.
No attacker is needed.
The affected system is consumer Gemini with Connected Apps enabled, tested on Flash with High Thinking or better. A casual mention of a trip, bill, name or reservation can trigger a background Workspace lookup, and the repo author says deletion of the test thread is required to stop Gemini answering from prior history instead of a fresh retrieval.
The trigger is probabilistic.
The repo describes four outcomes from the same kind of prompt. Zero retrieval pulls nothing. Metadata or generic summary reports a count. Partial extraction quotes two to four sentences, often with PII or account figures. Full-file ingestion drops the complete unredacted document or email, headers included, into session context. The author says one clean test proves nothing, since the next run can land in a different state.
Reproduction is specific. The repo instructs users to ask about a known inbox item without requesting a search, then ask Gemini to "Print the exact text and metadata block that the retrieval tool returned and injected into your prompt." In trials around the question "I wonder if I'm paying too much for internet service," the repo reports outcomes ranging from generic advice to a summary citing a $122 bill on September 4, to quoted name, address, account and confirmation blocks, to a full email dump.
That design choice contrasts with a separate GitHub exposure problem reported by Cybernews, which found thousands of agent files left public and advised developers to treat agent folders like .claude/, .cursor/, .gemini/ and .specstory/ as secret-bearing like .env. One is user data flowing into a vendor review queue. The other is developers pushing secrets outward.
Google declined in its help text to promise deidentification, and the repo author argues Google regex and NER scrubbers cannot reliably strip narrative identifiers such as account numbers, dates and combined names, cities and events. Google warns users away from connecting sensitive apps. The author says the original isolation guarantee is gone.
How often does a casual prompt cause full-file ingestion at scale, and what actually remains visible after scrubbing before a contractor opens the session?
