{
 "public_id": "AIR-2026-0014",
 "incident_id": "2026-01-google-gemini-calendar-invite-leak",
 "date_disclosed": "2026-01-19",
 "date_occurred": null,
 "title": "Gemini calendar-invite prompt injection leaks private meeting data into an attacker-readable event",
 "class": "responsible_disclosure",
 "attack_surface": "enterprise_assistant",
 "initial_vector": "indirect_prompt_injection_calendar_invite",
 "agent_capability_abused": [
  "calendar_retrieval",
  "calendar_write"
 ],
 "target_product": "Google Gemini (Google Calendar integration)",
 "target_vendor": "Google",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "data_exfiltration",
  "privacy_violation"
 ],
 "blast_radius": "Gemini users with Google Calendar connected; attacker only needs the victim's email address",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI01",
   "ASI02"
  ],
  "mitre_atlas": [],
  "labels": [
   "zero_click",
   "indirect_prompt_injection",
   "dormant_payload",
   "privacy_control_bypass",
   "self_exfiltration"
  ]
 },
 "defense_present": "Google Calendar privacy controls",
 "defense_bypassed": true,
 "fix_shipped": "Google mitigated the issue following responsible disclosure",
 "primary_sources": [
  "https://thehackernews.com/2026/01/google-gemini-prompt-injection-flaw.html"
 ],
 "verified_quote": "This bypass enabled unauthorized access to private meeting data and the creation of deceptive calendar events without any direct user interaction.",
 "confidence": "high",
 "notes": "Research by Liad Eliyahu, Head of Research at Miggo Security. Novel exfiltration channel: rather than an outbound HTTP request, Gemini writes a summary of the victim's private meetings into a NEW calendar event whose description the attacker can read. Miggo's own blog post URL could not be located, so The Hacker News coverage (which quotes the research directly) is used as the primary source per the curation rule. No CVE.",
 "risk_category": "privacy",
 "risk_secondary": [],
 "risk_subcategory": "Data Exfiltration via Context",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": false,
 "agency_reason": "Gemini wrote the private meeting data into an attacker-readable event",
 "vector_family": "indirect_prompt_injection",
 "vector_detail": "indirect_prompt_injection_calendar_invite",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI01",
 "agent_framework": "google_gemini_workspace",
 "model_provider": "google",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "data_exfiltration_channels",
 "eai_domain": "privacy",
 "eai_secondary": [
  "sensitive_data_exposure",
  "confused_deputy"
 ],
 "eai_reason": "subcategory: Data Exfiltration via Context",
 "asi_curated": [
  "ASI01"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI01 | added ASI02 (impact=tool_misuse)",
 "submitted_by": "EAI Internal"
}