Disclosed vulnerability
Gemini calendar-invite prompt injection leaks private meeting data into an attacker-readable event
AIR-2026-0014 AIR record · 2026-01-google-gemini-calendar-invite-leak
From the supporting source
This bypass enabled unauthorized access to private meeting data and the creation of deceptive calendar events without any direct user interaction.thehackernews.com
The record
Disclosed
2026-01-19
Vendor
Google
Product
Google Gemini (Google Calendar integration)
Risk domain
Privacy › Data exfiltration channels
Also touches
Sensitive data exposure, Confused deputy
System type
Generative model
Who acted
Agent acted — Gemini wrote the private meeting data into an attacker-readable event
Attack surface
Enterprise assistant
Autonomy level
Assistant
Initial vector
Indirect prompt injection calendar invite
Impact type
Data exfiltration, Privacy violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Gemini users with Google Calendar connected; attacker only needs the victim's email address
Capability abused
Defense & remediation
Recorded defense
Google Calendar privacy controls
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Google mitigated the issue following responsible disclosure
Taxonomy & references
Curator notes
Research by Liad Eliyahu, Head of Research at Miggo Security. Novel exfiltration channel: rather than an outbound HTTP request, Gemini writes a summary of the victim's private meetings into a NEW calendar event whose description the attacker can read. Miggo's own blog post URL could not be located, so The Hacker News coverage (which quotes the research directly) is used as the primary source per the curation rule. No CVE.
Cite as
Enkrypt AI. "Gemini calendar-invite prompt injection leaks private meeting data into an attacker-readable event". AIR, AIR-2026-0014. https://agentincident.vercel.app/i/AIR-2026-0014/ (accessed 2026-10-19).