Case gemini-calendar-invite-hijackAgent hijackIsrael
Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes
Researchers from Tel Aviv University, Technion and SafeBreach showed 14 indirect prompt injections where hidden text in Google Calendar invites made Gemini open shutters, start Zoom calls and delete events.
HighAttack on AIStatus: PatchedVerified case file
Open in the interactive mapCite this case
- Reported
- Aug 6, 2025
- Location
- Israel
- Target
- Google Gemini assistant and Google Home integrations
- Severity
- High
- Triggered by
- Ben Nassi, Stav Cohen and Or Yair (Tel Aviv University, Technion, SafeBreach)
- Actor type
- Security researchers
- Reported loss
- None reported
- CVE
- None
What happened
Researchers from Tel Aviv University, Technion and SafeBreach showed 14 indirect prompt injections where hidden text in Google Calendar invites made Gemini open shutters, start Zoom calls and delete events.
Impact: First widely documented prompt injection with physical-world effects: smart home devices actuated, spam sent, browser content read and calendar events deleted in lab demos. No real-world victims reported
Who triggered it
Actor: Ben Nassi, Stav Cohen and Or Yair (Tel Aviv University, Technion, SafeBreach)
Attribution: Academic responsible disclosure presented at Black Hat USA 2025; coordinated with Google
Motive: Security research
How it happened
Attack vector: Hidden instructions in Google Calendar invite titles and descriptions, triggered when the user asks Gemini about their schedule or replies with everyday words, using delayed automatic tool invocation
Root cause: Gemini treated calendar content as trusted context and could invoke connected tools (Google Home, Zoom, Calendar) without a separate confirmation step
Timeline
- Researchers report the attacks to Google
- Findings presented at Black Hat USA and published as Invitation Is All You Need
- Google says it rolled out filtering, model hardening and new user confirmations
Response
Google deployed mitigations including output filtering, prompt-injection classifiers and confirmation prompts for sensitive actions
Current status: Patched
Sources (open in a new tab)
Cite this case
Invitation Is All You Need: poisoned calendar invites make Gemini control smart homes. AI Threat Watch, case gemini-calendar-invite-hijack, Aug 6, 2025. https://aithreat.io/cases/gemini-calendar-invite-hijack/
Permanent link: https://aithreat.io/cases/gemini-calendar-invite-hijack/