--- title: "RCE via Gemini Live AI Voice Session Misconfiguration. Injecting Client-Controlled Setup Frames Through Unconstrained Ephemeral Tokens" url: https://daily.dev/posts/rce-via-gemini-live-ai-voice-session-misconfiguration-injecting-client-controlled-setup-frames-thro-p1wmzxx9l source_url: https://infosecwriteups.com/rce-via-gemini-live-ai-voice-session-misconfiguration-e0648805a055 type: article source: "InfoSec Write-ups" published: 2026-07-06T07:28:43.753Z updated: 2026-07-06T07:29:07.976Z tags: ["security", "google-gemini", "websocket"] reading_time: 12 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # RCE via Gemini Live AI Voice Session Misconfiguration. Injecting Client-Controlled Setup Frames Through Unconstrained Ephemeral Tokens **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 12 min read · 0 upvotes · 0 comments ## Summary A security researcher discovered that Google's Gemini Live API ephemeral token system allows remote code execution when backends issue tokens without populating the live_connect_constraints field. The BidiGenerateContentConstrained WebSocket endpoint is only constrained if the backend explicitly locks session parameters in the token — without this, any authenticated client can inject arbitrary setup frames including system instructions and tools like Python code execution. The vulnerability stems from Google's official reference implementation omitting the constraint configuration, meaning any team following the example ships the same misconfiguration. The fix is adding bidi_generate_content_setup to the token creation call. The sandbox used is gVisor, which limits impact but still allows arbitrary Python execution and compute abuse. The researcher provides a nonce-based proof protocol to distinguish real sandbox execution from model inference. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel](https://daily.dev/posts/taming-agentic-browsers-vulnerability-in-chrome-allowed-extensions-to-hijack-new-gemini-panel-wrgfp6s8g) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#google-gemini](https://daily.dev/tags/google-gemini), [#websocket](https://daily.dev/tags/websocket) [View this post on daily.dev](https://daily.dev/posts/rce-via-gemini-live-ai-voice-session-misconfiguration-injecting-client-controlled-setup-frames-thro-p1wmzxx9l)