Colab's AI was told to keep its links clean. Then it was told to become a pirate, and it listened.

What happened

A security researcher found that Gemini in Colab could be made to render attacker-controlled images that leak data, and Google fixed it without a reward. After Colab began putting notebook content into the prompt, the researcher showed prompt injection could produce clickable links that exfiltrate chat and code, bypassing the confirmation page for Google domains.