“Indirect Prompt Injection attacks via Emails or Google Docs are interesting threats, because these can be delivered to users without their consent.”
Google gave Bard access to your Drive, Docs and Gmail, then let it render markdown images. An attacker force-shares a Google Doc, Bard reads it, and your chat history leaves in an image URL. The Content Security Policy didn’t help because the drop box was an Apps Script running on Google’s own domain. Google built the attack surface and supplied the getaway car.