Gemini Live API Token Flaw: How a Missing Field Let Attackers Hijack AI Voice Sessions

In late June 2026, security researcher Alvin Ferdiansyah published a detailed breakdown of what he described as a critical misconfiguration in Google's Gemini Live API ephemeral token system. The flaw, if confirmed, allows an attacker who obtains a short-lived WebSocket token to hijack a browser-based AI voice session — controlling the model, system prompt, and even the tools the session can execute.

The core of the vulnerability is a missing security field during token minting. Here is what we know, what is still unconfirmed, and how developers can protect their deployments right now.

How the Gemini Live API ephemeral token system works

The Gemini Live API supports browser-to-server WebSocket connections using ephemeral tokens — short-lived authentication tokens that expire quickly and can be restricted to specific uses . These tokens are minted by a backend server and then handed to the client, which uses them to connect directly to the Gemini API without exposing the underlying API key.

Google documentation explains that ephemeral tokens are designed for client-to-server implementations where security is a concern, because even if extracted from a browser, the token's short lifetime limits damage . The endpoint for these constrained connections is BidiGenerateContentConstrained, which accepts the ephemeral token as an access_token query parameter .

The missing live_connect_constraints field

According to Ferdiansyah's write-up, the reference implementation for token minting omitted the live_connect_constraints field . This field is supposed to contain a bidi_generate_content_setup object that binds the token to a specific model, system instruction, and set of tools.

When live_connect_constraints is left empty or absent, no constraints are enforced. An attacker who obtains the ephemeral token can then send a client-controlled setup frame specifying any model, system prompt, and tools they choose. The server, lacking token-bound values to validate against, accepts the attacker's configuration.

Important caveat: The provided sources do not include Google's official documentation for live_connect_constraints, a CVE, or a Google security advisory confirming this behavior. The claim comes from Ferdiansyah's Medium post and should be treated as unverified but plausible .

Impact: What an attacker could do with an unconstrained token

If the vulnerability is real, the consequences are significant for any application using the Gemini Live API in a browser context:

• Sandboxed code execution via tools — The Gemini Live API examples include client-side support for adding custom tools . An attacker who can inject a malicious tool definition could potentially execute code within the application's sandbox.
• Compute abuse — A hijacked session consumes the victim application's quota and billing allocation. Because ephemeral tokens are designed for single-use connections, an attacker could also repeatedly request new tokens through the backend's minting endpoint, potentially driving up costs .
• Prompt tampering — Controlling the setup frame means controlling the system instruction. An attacker could repurpose the session to extract sensitive information, generate harmful content, or impersonate a trusted agent .
• Repeated session abuse — Live API sessions have a connection limit of approximately 10 minutes . An attacker would need to reconnect, but using the same unconstrained token flow, they could re-hijack the session repeatedly.

Developers on the Google AI forum have reported issues with ephemeral tokens ignoring system instructions and failing to work as expected with constrained endpoints, suggesting the broader ecosystem is still maturing .

The one-field fix

The remediation described by Ferdiansyah is straightforward: populate the

live_connect_constraints.bidi_generate_content_setup

1. model — The exact Gemini model to use (e.g., models/gemini-2.5-flash-native-audio-latest).
2. system_instruction — The intended system prompt, structured as parts containing text.
3. tools — An empty array [] or only explicitly allowed tools, preventing client-side injection.

Here is the illustrative Python code from Ferdiansyah's write-up :

token = gemini_client.auth_tokens.create({
    "uses": 1,
    "expire_time": now + timedelta(seconds=60),
    "new_session_expire_time": now + timedelta(seconds=60),
    "live_connect_constraints": {
        "bidi_generate_content_setup": {
            "model": "models/gemini-2.5-flash-native-audio-latest",
            "system_instruction": {
                "parts": [{"text": "You are a customer support assistant..."}]
            },
            "tools": []
        }
    }
})

Note: Because live_connect_constraints is not documented in the official Google API reference provided in the sources, this example is based on Ferdiansyah's own description and should be tested against the actual API before production use .

What is still unconfirmed

The following key points remain unverified by the provided sources:

• No official Google documentation confirms the existence or schema of live_connect_constraints.
• No CVE or security advisory has been published.
• No independent reproduction of the exploit is included in the sources.
• The exact behavior of the BidiGenerateContentConstrained endpoint when receiving an unconstrained token is not documented in the provided official references .

What developers should do now

Until Google publishes an official advisory, the safest approach is to treat the vulnerability as plausible and apply the fix proactively:

1. Audit your ephemeral token minting code — Check whether your backend populates live_connect_constraints or its equivalent field.
2. Never expose raw API keys — Always use ephemeral tokens for browser-facing connections .
3. Set tight token expiration — Google recommends newSessionExpireTime of around 60 seconds to limit the window for token theft .
4. Validate setup frames server-side — Even if clients send their own configuration, your backend should enforce the intended model, prompt, and tools.
5. Monitor for abuse — Watch for unusual session patterns, especially repeated connections from the same token or unexpected tool invocations.

The Gemini Live API is a powerful tool for building real-time voice and video experiences. A single missing field in the token minting process should not undermine that capability — but developers must ensure their implementations are complete.

This article was fact-checked against 27 provided sources, including official Google documentation, community forum discussions, and the original researcher's write-up. Key claims from the researcher could not be independently verified from official sources at the time of publication.