Poisoned calendar invite hijacks Google Gemini to control smart-home devices
Researchers from Tel Aviv University, the Technion and SafeBreach showed that a Google Calendar invite carrying an indirect prompt injection in its title could hijack Gemini when the victim later asked it to summarise upcoming events, invoking its agents to open connected windows, switch on a boiler, turn off lights, start Zoom calls, send spam and steal email and meeting details. They demonstrated 14 attacks and rated 73% of the threats high or critical risk. Google said the flaws were not exploited by malicious hackers and deployed multiple fixes, including stronger confirmations for sensitive actions, before the August 2025 disclosure.
The researchers reported their findings to Google in February 2025. To get around a Google mitigation against chaining agents, they used delayed tool invocation, so that a later reply such as 'thanks' opened the windows. Google contended the researchers had changed default settings on who can add calendar invites; the researchers said some attacks also worked via email subjects or document titles.
Disputed. Google contends that the researchers changed default settings on who can add invites to a calendar and described the paper's techniques as theoretical; the researchers say some of the attacks also worked through email subjects or document titles.
What would have stopped it
Require explicit user confirmation for physical-world or outbound actions triggered while processing third-party content.
Guardrails
- G1 Least privilege Not assessed Did the agent hold only the access the task needed?
- G2 Human confirmation Partial Delayed triggers fired on innocuous replies like 'thanks'; Google later added confirmations for sensitive actions.
- G3 Isolation Partial Google blocked direct chaining between agents, but delayed tool invocation bypassed it.
- G4 Instruction integrity Failed Gemini followed instructions embedded in an attacker's calendar invite.
- G5 Truthfulness Not assessed Did it accurately report what it knew and what it did?
- G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
- G7 Oversight Not assessed Could a responsible human see what it was doing and stop it in time?
- G8 Recovery Not assessed Could the damage be undone?
Sources
-
“Along the way, we were able to demonstrate a number of different exploitations of Targeted Promptware against Gemini that were initiated simply by an attacker sending a Google Calendar invite to a victim whose name contained an indirect prompt injection.”
-
“When the researchers subsequently ask Gemini to summarize their upcoming calendar events for the week, those dormant instructions are triggered, and the products come to life.”
Confidence 87% comes from these sources alone. How we score
History
- 14 Oct 2026Entered in the register with 2 sources