A security researcher discovered that Google's Gemini Live API ephemeral token system allows remote code execution when backends issue tokens without populating the live_connect_constraints field. The BidiGenerateContentConstrained WebSocket endpoint is only constrained if the backend explicitly locks session parameters in the token — without this, any authenticated client can inject arbitrary setup frames including system instructions and tools like Python code execution. The vulnerability stems from Google's official reference implementation omitting the constraint configuration, meaning any team following the example ships the same misconfiguration. The fix is adding bidi_generate_content_setup to the token creation call. The sandbox used is gVisor, which limits impact but still allows arbitrary Python execution and compute abuse. The researcher provides a nonce-based proof protocol to distinguish real sandbox execution from model inference.
