Researchers Demonstrate Prompt Injection Attack on Google Gemini via Calendar Invite
Researchers from Tel Aviv University demonstrated a prompt injection vulnerability in Google Gemini that allows malicious calendar invites to trick the AI into controlling smart home devices. Google reportedly fixed the issue before it could be exploited in the wild after the researchers disclosed their findings responsibly in February 2025.
What happened
Researchers from Tel Aviv University, including Ben Nassi, Stav Cohen and Or Yair, demonstrated a prompt injection vulnerability in Google Gemini that could be exploited through malicious calendar invites. A specially crafted prompt hidden in a Calendar invite title is read by Gemini the same way it scans other Google app data, such as email summaries, and can be designed to give Gemini a specific order to control smart home devices.
The demonstrated attacks, presented at the Black Hat computer-security conference, showed how the right Gemini prompts could be used to open windows, turn off lights, turn on a boiler or geolocate the current user. The researchers' report, titled 'Invitation is All You Need', showed that similar commands could be hidden in calendar invite titles, email subject lines or other data scanned by Gemini to create hidden agents that wait for common responses like saying 'thank you' in an email to trigger actions.
Reported impact
The vulnerability demonstrated potential for unauthorized control of Google Home-connected smart devices and could lead to spam messages, deleted events, and automatic Zoom streaming.
Index analysis
The attack exploits how Gemini is designed to respond to basic commands in English and processes data from multiple Google applications without distinguishing between legitimate commands and injected prompts. The vulnerability affected Gemini's integration with Google Home and other Google app data processing.
Google told CNET it introduced multiple fixes to address the vulnerabilities after the researchers provided their report in February 2025. Andy Wen, senior director of security product management at Google Workspace, stated that Google 'fixed this issue before it could be exploited' and that the research 'accelerated our work to deploy new, cutting edge defenses which are now in place protecting users.'
Governance controls
The researchers disclosed their findings responsibly to Google in February 2025 before presenting at Black Hat, allowing the company to implement fixes. Google deployed mitigations prior to the public disclosure of the vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.