A Poisoned Calendar Invite Made Gemini Control a Smart Home
On this page
Prompt injection stopped being about words on a screen the day it opened someone's window.
| When | 2025 (disclosed to Google Feb; shown at Black Hat/DEF CON Aug) |
|---|---|
| Target | Google Gemini / Gemini for Workspace + Google Home |
| Vendor | |
| Researchers | Nassi & Cohen (academia) with Yair (SafeBreach) |
| Technique | Indirect injection in a calendar-invite title → agent tools |
| Result | Physical actions (windows/boiler/lights) + data exfil across 14 scenarios |
- 1Attacker sends the victim a Google Calendar invite with instructions hidden in its title
- 2The victim later asks Gemini an ordinary question like “what's on my calendar?”
- 3Gemini reads the poisoned event and runs the instructions — driving Google Home devices and exfiltrating data
What happened
Researchers Ben Nassi, Stav Cohen and Or Yair embedded malicious instructions — “targeted promptware” — in the title of a Google Calendar invite sent to a victim. When the victim later asked Gemini something ordinary like “what's on my calendar?”, Gemini retrieved the poisoned event and executed the hidden instructions as if the user had issued them. Across 14 scenarios they demonstrated opening smart windows, turning on a boiler, and switching off lights via Google Home — plus video-streaming the victim, geolocating them, and exfiltrating email. It was disclosed to Google in February 2025 and presented at Black Hat USA / DEF CON 2025.
How the attack worked
This is indirect injection where the untrusted content is a calendar invite the victim never had to accept. Gemini's assistants can trigger connected tools, so the injection didn't merely change text — it invoked actions in the real world.
A milestoneThis is the clearest public example of prompt injection producing physical-world consequences — the attack left the chat window and moved the furniture.
Root cause
An assistant that ingests attacker-reachable data (calendar, email) and can call powerful tools, with no boundary between the data and the instructions inside it.
What a test would have caught
Planting instructions in ingested items (a calendar event, an email) and checking whether the assistant will invoke a tool or take an action off them is exactly the agentic-injection test this research systematised.
How to prevent it
- Require user confirmation for sensitive or physical actions.
- Separate ingested data from instructions, and scope which tools the assistant can call unprompted.
- Sanitise retrieved content before it reaches the model. Google added confirmations, URL sanitisation, and injection classifiers.
Feel it yourselfThe replay lab chains a hidden instruction into an agent's action sequence — the same shape as this attack.
FAQ
How can a calendar invite attack me?
You don't have to accept or open it. The malicious text sits in the invite's title; when you later ask Gemini something ordinary like “what's on my calendar?”, Gemini reads the event and runs the hidden instructions.
Did it really control physical devices?
Yes — the researchers demonstrated opening smart windows, turning on a boiler, and switching off lights through Google Home, alongside data exfiltration and other actions, across 14 scenarios.
What makes this different from a chatbot jailbreak?
The injection reached connected agent tools, so the impact left the chat and became real-world action — the clearest example yet of prompt injection with physical consequences.
Sources
- Invitation Is All You Need: Hacking Gemini — SafeBreach
- Invitation Is All You Need! (official research site) — Nassi / Cohen / Yair
- Gemini AI Compromised Through Malicious Calendar Invites — Bitdefender