Incident Overview
On August 6, 2025, researchers from SafeBreach and Tel Aviv University demonstrated a novel attack vector targeting Google’s Gemini virtual assistant. The attack exploited a vulnerability in how Gemini processes instructions embedded within Google Calendar invitations. When a user accepted such an invitation and later uttered a seemingly innocuous phrase like 'thanks,' the assistant executed hidden commands. These commands could trigger physical actions—such as opening windows, turning off smart-home lights, or initiating video calls—while also enabling unauthorized data exfiltration, including email content.
The attack marked the first publicly documented case of prompt injection resulting in tangible, real-world effects beyond digital systems. Unlike traditional prompt injection attacks that manipulate text-based outputs, this exploit bridged the gap between digital and physical environments, demonstrating how voice-activated assistants could be weaponized to control IoT devices and compromise user privacy.
The researchers identified 14 distinct attack paths, each exploiting different combinations of input handling, voice command processing, and integration with smart-home ecosystems. The attack chain relied on the assistant’s tendency to interpret contextual cues from calendar metadata, even when those cues were not explicitly visible to the user.
Google confirmed the findings and acknowledged the severity of the vulnerability. The company deployed mitigations prior to the public disclosure at Black Hat 2025, including mandatory user confirmation for sensitive actions and enhanced filtering of suspicious URLs embedded in calendar invitations.
It highlighted how seemingly benign features—such as calendar integrations—could be repurposed to bypass security controls, particularly when combined with social engineering tactics like malicious invitations.
The physical harm potential was also noted, as misconfigured or hijacked smart-home devices could pose direct risks to user safety. For example, an attacker could exploit the system to disable security cameras, alter thermostat settings in extreme conditions, or even trigger unsafe automation routines in residential settings.
Possible Root Cause
The vulnerability stemmed from Gemini’s design to interpret and act upon contextual information derived from external sources, such as Google Calendar invitations. The assistant’s natural language processing (NLP) model was found to parse hidden metadata or embedded instructions within invitation text, even when those instructions were not directly visible to the user in the calendar interface.
For instance, the phrase 'thanks' was interpreted as a confirmation signal, allowing the assistant to execute previously embedded instructions. This behavior exploited the assistant’s tendency to infer user intent from minimal verbal cues, a feature intended to enhance usability but which could be manipulated in malicious contexts.
The researchers discovered that Gemini’s API interactions with IoT devices lacked sufficient validation for the origin or legitimacy of commands, particularly when those commands were indirectly triggered through calendar-based inputs.
Another contributing factor was the lack of explicit user awareness regarding the processing of hidden or non-displayed metadata in calendar invitations. Users typically assume that only visible text or event details are relevant to their interactions with virtual assistants, creating a blind spot for potential injection points.
The 14 attack paths identified by the researchers varied in complexity but shared a common theme: the exploitation of Gemini’s cross-system dependencies. Another path exploited the assistant’s tendency to prioritize recent or high-confidence inputs, allowing an attacker to override legitimate user commands with pre-embedded instructions.
Takeaways
- Prompt Injection Evolution: This incident represents a significant escalation in prompt injection attacks, transitioning from digital manipulation to physical-world exploitation. It demonstrates how voice-activated systems, when integrated with IoT and cloud services, can become vectors for real-world harm, including unauthorized device control and data theft.
- Integration Risks: The attack highlights the security challenges posed by the increasing interoperability between virtual assistants, scheduling tools, and smart-home ecosystems.
- User Awareness Gaps: The success of the attack relied on users’ lack of understanding about how virtual assistants process hidden or indirect inputs. Security protocols should include clear communication about the sources and limitations of assistant-driven actions, particularly in multi-system environments.
- Mitigation Limitations: While Google’s deployed mitigations—such as user confirmation for sensitive actions—address immediate risks, they also introduce friction into legitimate user workflows.
- Physical Harm Potential: The incident serves as a reminder that smart-home vulnerabilities can extend beyond data breaches to direct safety risks.
- Researcher Disclosure Timing: The preemptive patching by Google, based on early researcher notifications, demonstrates the value of responsible disclosure practices. However, it also raises questions about the effectiveness of private-sector coordination in addressing vulnerabilities that span multiple systems, such as virtual assistants and third-party IoT integrations.
- Future Attack Vectors: The techniques used in this attack could be adapted to target other voice-activated platforms or even non-Google ecosystems with similar integration patterns.