Disclosed vulnerability
Invitation Is All You Need: Gemini promptware via Google Calendar invites reaching Workspace and smart-home actions
AIR-2025-0083 AIR record · 2025-08-google-gemini-calendar-promptware
From the supporting source
we were able to demonstrate a number of different exploitations of Targeted Promptware against Gemini that were initiated simply by an attacker sending a Google Calendar invite to a victim whose name contained an indirect prompt injection.safebreach.com
The record
Disclosed
2025-08-06
Vendor
Google
Product
Google Gemini (web, Android app, Assistant)
Risk domain
Privacy › Data exfiltration channels
Also touches
Human manipulation, Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini invoked Workspace and smart-home tools, actuating devices
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection calendar invite
Impact type
Data exfiltration, Physical world action, Location tracking, Unauthorized tool invocation, Physical actuation, Spam propagation, Phishing, Surveillance, Spam
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Gemini for Workspace users; anyone who can send the victim a calendar invite
Capability abused
Defense & remediation
Recorded defense
Gemini prompt-injection mitigations
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Google shipped mitigations following disclosure
Taxonomy & references
Curator notes
SafeBreach Labs with Tel Aviv University / Technion collaborators. Notable as one of the first demonstrated cyber-to-physical consequences (opening windows, controlling boilers) from an LLM prompt injection. Also reported under the titles: 'Invitation Is All You Need: promptware attacks on production Gemini assistants via Google Calendar invites'; 'Invitation Is All You Need: promptware hijacks Gemini for Workspace agents via a Google Calendar invite'.
Supporting sources
Cite as
Enkrypt AI. "Invitation Is All You Need: Gemini promptware via Google Calendar invites reaching Workspace and smart-home actions". AIR, AIR-2025-0083. https://agentincident.vercel.app/i/AIR-2025-0083/ (accessed 2026-10-19).