Gemini Accused of Leaking Secrets, Google Denies Training

Gemini Revealed a Character Name It Should Not Have Known

On August 8, Google Gemini became embroiled in a privacy controversy whose cause has yet to be determined.

An independent game developer recently discovered that when a player used Gemini to search for a game the studio was developing, the model mentioned an unreleased character named “Vantage Tripod” in its response. According to the developer, the character’s name existed only in a private Google Docs document. It had neither been publicly released nor included in any game files accessible to players.

If this account is accurate, the question is straightforward: Why did Gemini know something that, in theory, existed only in a private document?

Google denied the allegation. The company said it does not scan private Google Docs documents or use them to train Gemini. Gemini accesses Workspace files only when a user explicitly requests it and grants the necessary permissions. Google also noted that if a document link had ever been posted online with public access enabled, it could have been discovered and indexed by search engine crawlers, and that users control the sharing permissions of Workspace files.

As of August 8, neither side had presented enough evidence to establish technical attribution. The developer’s discovery is cause for concern, but it is not yet possible to conclude that “Gemini was trained on private Google Docs and then repeated their contents to other users.”

Google Denied Using the Document for Training, but Did Not Explain Where the Information Came From

Google’s response can easily create a false impression: If the company denies using private documents for training, then no leak occurred.

In reality, “whether data was used for training” and “whether the system accessed data during generation” are two separate questions.

A large language model can come into contact with information at several stages:

• Pre-training or post-training: Content enters the training dataset and is transformed into statistical associations within the model’s parameters;
• Retrieval-augmented generation: When answering a question, the model temporarily retrieves content from a search index, enterprise knowledge base, or cloud file;
• Conversation and memory: A user previously entered relevant information into a Gemini conversation, and the system uses it in a later response;
• Tool use: A user authorizes Gemini to access Drive, Docs, Gmail, or browser tabs;
• External exposure: Document content reaches the internet through a public link, cache, third-party plugin, log, screenshot, or another user.

Google’s statement that it does not use private documents for training therefore rules out only one possible path. It does not automatically explain why Gemini generated the name “Vantage Tripod.”

This is the real issue that deserves scrutiny. Training-data leakage is generally difficult to pinpoint, while unauthorized retrieval, misconfigured permissions, and search-index contamination are often easier to reconstruct through logs. To fully clarify the incident, Google would need to explain whether the response used Google Search, a Workspace connector, user memory, or another grounding source, rather than merely reiterating its training policies.

A “Private Document” May Not Have Always Been Private

Based on the available information, indexing of a publicly accessible link remains the most plausible possibility—and the one that should be investigated first.

“Private” can mean at least three different things in Google Docs: accessible only to the document owner, accessible to anyone with the link, or accessible to anyone on the internet. Ordinary users may describe either of the latter two settings as “I never published it publicly.” But from a search engine’s perspective, if the URL was posted to a forum, chat log, task management system, test page, or public code repository, it could have entered a crawler’s queue.

Even if the document was later changed back to restricted access, its title, snippets, cached pages, or other webpages that referenced it might still exist. An unreleased character name could also have appeared in any of the following places:

1. A studio member shared the document link in a public or semi-public group;
2. A tester pasted the character’s name into Gemini, a search box, or another AI tool;
3. Project management, translation, crash reporting, telemetry, or version control systems retained the relevant string;
4. A browser extension, third-party integration, or automation tool read the document’s contents;
5. The name was briefly exposed through a game store backend, preview assets, structured data, or an unlinked webpage;
6. Gemini never accessed the original text and simply generated the same name by coincidence.

The last possibility cannot be ruled out entirely. However, if “Vantage Tripod” is sufficiently distinctive and Gemini also provided multiple accurate details about the character’s background and the game it belongs to, the probability of pure coincidence would fall significantly. Conversely, if the response contained only those two common English words and everything else was inaccurate, it may simply have been a striking-looking hallucination.

The key question is not whether the model “got one term right,” but whether it can reproduce the information consistently, whether it includes context available only inside the document, and whether the response cites any source links.

Consumer, Workspace, and Cloud Products Must Not Be Conflated

The controversy also exposes a common problem in discussions of AI privacy: They are all called Gemini, but different products do not necessarily have the same data boundaries.

The consumer-facing Gemini app may retain conversation activity and, when the relevant features are enabled, reference past conversations or saved information to provide personalized responses. Sensitive information that users voluntarily enter into conversations may also remain in activity records until the user deletes it. Temporary chats, memory controls, and activity-record management address conversation retention and personalization.

Gemini in enterprise Workspace environments, by contrast, emphasizes permission inheritance: The model can retrieve only documents, emails, and cloud-drive content that the current user is already authorized to access. In theory, if a user cannot open a file, Gemini should not be able to bypass those permissions through a connector and retrieve its contents. Organization-level data loss prevention, information rights management, and client-side encryption can further restrict the flow of content.

Products such as Gemini for Google Cloud and the enterprise edition of Code Assist have separate data governance commitments. Google’s public documentation states that prompts submitted and responses generated in these scenarios are not used to train models. Code context also generally must be explicitly enabled and is used for code customization or completion tasks within the current organization.

These policy differences mean that before asking whether “Gemini uses data for training,” several questions must first be answered: Which Gemini product was used? What type of account was involved? Were Workspace extensions enabled? What were the document’s permissions? Was the person submitting the query in the same organization as the document? Did the response use search grounding?

Reducing every scenario to “AI snoops on documents” is inaccurate. Interpreting Google’s denial to mean that “no Gemini data pathway could ever leak information” is equally indefensible.

What Is Really Needed Is the Data Access Chain, Not Verbal Assurances

Determining whether this was a product-level data leak would require at least the following evidence:

• The original Gemini prompt, complete response, generation time, and account type;
• Any source links, search-grounding indicators, and quoted snippets displayed in the response;
• The Google Docs document’s permission-change history and access logs;
• Whether the document link ever appeared on a webpage, in a messaging app, in an issue tracker, on a forum, or in a public repository;
• Whether the character name existed in local build artifacts, test packages, crash logs, or third-party platforms;
• Whether the same result can be reproduced with the same prompt across different accounts, regions, and conversations;
• Whether the answer remains reproducible after the search index is removed or connector permissions are revoked.

It is especially important to distinguish between “the model remembered it” and “the system found it through search.” If a completely new account can still consistently generate the same internal character details without displaying any sources, suspicions of training-data contamination or cross-user information leakage would increase. If only accounts with Workspace permissions can obtain the answer, authorized retrieval is more likely. If the answer disappears along with the search result, the issue is probably related to indexing.

Current public reporting does not include all of the above material, nor has an independent security researcher published a reproducible report. The evidence is therefore still insufficient to describe the incident as a confirmed Gemini data leak.

For Development Teams, This Is Already Enough to Sound the Alarm

Even if the issue is ultimately shown to have resulted from an incorrectly shared document, the incident still has practical significance: Generative AI has turned previously obscure data-exposure paths into natural-language query interfaces.

In the past, someone had to find, open, and understand a document leaked in some obscure corner of the internet. Now, a search-grounded model can automatically retrieve and summarize it, then deliver the information to a user in a single complete sentence. AI may not have created the permissions error, but it significantly lowers the barrier to exploiting it.

Development teams should not rely solely on vendors’ promises that data “will not be used for training.” More practical measures include:

• Disable “Anyone with the link” access by default, and use explicit member allowlists for design documents, source code, and financial information;
• Regularly audit external-sharing permissions in Drive and Docs, especially for files created by former employees, contractors, and test accounts;
• Add unreleased character names, project code names, API keys, and customer data to data loss prevention rules;
• Separate personal AI accounts from enterprise-managed accounts, and prohibit employees from pasting sensitive information into unapproved consumer AI services;
• Review the Drive read permissions granted to browser extensions, document add-ons, and automated workflows;
• Enable client-side encryption for highly sensitive documents and retain logs of access and permission changes;
• Proactively search for internal code names and distinctive strings before launch to determine whether search engines or AI question-answering systems have already discovered them.

It is especially important to note that API submissions, enterprise products, and consumer chat applications often follow different data policies. Developers should not assume that because a vendor promises not to use enterprise API data for training, employees who upload files through a personal web account receive exactly the same protection.

This Is Not Conclusive Proof, but Google Needs to Provide a More Specific Explanation

At this stage, the more cautious conclusion is that this was an anomalous information-exposure incident whose credibility remains to be verified—not a fully attributed data breach.

The developer identified a specific, verifiable anomaly, while Google provided a general statement of product policy. The most critical piece is still missing: the actual data access chain behind that particular Gemini response.

Google’s denial carries some weight because model training, Workspace retrieval, and search indexing are indeed separate systems. But its response is incomplete. Users are not merely asking what Google does in principle; they want to know exactly where the character’s name came from in this specific response.

Until access logs, indexing records, or reproducible tests become available, responsibility should not be attributed directly to model training. At the same time, the absence of training does not justify ignoring potential retrieval and permissions issues. For development teams that increasingly rely on AI systems connected to enterprise documents, this controversy once again shows that the greatest danger may not be a model memorizing a secret, but connectors, search indexes, and sharing permissions working together to turn that secret into a queryable answer.

References

• ITHome: Google Denies Using Private Documents to Train Gemini After Developer Alleges Unreleased Content Was Leaked — Summarizes the independent game developer’s allegations, the name of the character involved, and Google’s response regarding access to private Docs documents and model training.