genai
SECURITY LAB
IncidentsAgent abuse

A Poisoned Calendar Invite Made Gemini Control a Smart Home

High severityAugust 2025LLM01: Prompt InjectionLLM03: Excessive Agency
Status: Disclosed to Google Feb 2025; presented at Black Hat USA / DEF CON 2025; Google deployed layered mitigations
On this page

Prompt injection stopped being about words on a screen the day it opened someone's window.

When2025 (disclosed to Google Feb; shown at Black Hat/DEF CON Aug)
TargetGoogle Gemini / Gemini for Workspace + Google Home
VendorGoogle
ResearchersNassi & Cohen (academia) with Yair (SafeBreach)
TechniqueIndirect injection in a calendar-invite title → agent tools
ResultPhysical actions (windows/boiler/lights) + data exfil across 14 scenarios
Attack flow
  1. 1Attacker sends the victim a Google Calendar invite with instructions hidden in its title
  2. 2The victim later asks Gemini an ordinary question like “what's on my calendar?”
  3. 3Gemini reads the poisoned event and runs the instructions — driving Google Home devices and exfiltrating data

What happened

Researchers Ben Nassi, Stav Cohen and Or Yair embedded malicious instructions — “targeted promptware” — in the title of a Google Calendar invite sent to a victim. When the victim later asked Gemini something ordinary like “what's on my calendar?”, Gemini retrieved the poisoned event and executed the hidden instructions as if the user had issued them. Across 14 scenarios they demonstrated opening smart windows, turning on a boiler, and switching off lights via Google Home — plus video-streaming the victim, geolocating them, and exfiltrating email. It was disclosed to Google in February 2025 and presented at Black Hat USA / DEF CON 2025.

How the attack worked

This is indirect injection where the untrusted content is a calendar invite the victim never had to accept. Gemini's assistants can trigger connected tools, so the injection didn't merely change text — it invoked actions in the real world.

A milestoneThis is the clearest public example of prompt injection producing physical-world consequences — the attack left the chat window and moved the furniture.

Root cause

An assistant that ingests attacker-reachable data (calendar, email) and can call powerful tools, with no boundary between the data and the instructions inside it.

What a test would have caught

Planting instructions in ingested items (a calendar event, an email) and checking whether the assistant will invoke a tool or take an action off them is exactly the agentic-injection test this research systematised.

How to prevent it

  • Require user confirmation for sensitive or physical actions.
  • Separate ingested data from instructions, and scope which tools the assistant can call unprompted.
  • Sanitise retrieved content before it reaches the model. Google added confirmations, URL sanitisation, and injection classifiers.

Feel it yourselfThe replay lab chains a hidden instruction into an agent's action sequence — the same shape as this attack.

FAQ

How can a calendar invite attack me?

You don't have to accept or open it. The malicious text sits in the invite's title; when you later ask Gemini something ordinary like “what's on my calendar?”, Gemini reads the event and runs the hidden instructions.

Did it really control physical devices?

Yes — the researchers demonstrated opening smart windows, turning on a boiler, and switching off lights through Google Home, alongside data exfiltration and other actions, across 14 scenarios.

What makes this different from a chatbot jailbreak?

The injection reached connected agent tools, so the impact left the chat and became real-world action — the clearest example yet of prompt injection with physical consequences.

Replay this attack
Chain a hidden instruction into an agent's action sequence — the same shape as the poisoned-invite attack.
Open the live lab
Runs as a live, sandboxed lab. Sign-in required — this replay is a Pro lab. Recreates the attack class, not this exact branded bot.