Security researchers demonstrated that malicious instructions hidden in a Google Calendar invitation could influence Gemini-powered assistants and trigger actions on connected devices. The test included turning off lights, opening motorized windows or shutters, and activating a boiler. It was a controlled demonstration of indirect prompt injection—not evidence that criminals breached Google, that every Google Home installation was exposed, or that a live attack campaign affected users.
What happened
Ben Nassi of Tel Aviv University, Stav Cohen of Technion–Israel Institute of Technology, and Or Yair of SafeBreach created calendar invitations containing attacker-written instructions. When a target asked Gemini to summarize or list calendar events, the assistant retrieved the invitation and incorporated its text into the conversation context.
As an Amazon Associate I earn from qualifying purchases.
The injected text attempted to make Gemini behave as another agent, such as a Google Home controller. In the demonstrations, a later ordinary phrase—including a response such as “thanks”—could act as the trigger for a delayed action. Gemini then attempted to invoke connected applications or smart-home controls.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →The researchers described the work in the paper “Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous.” WIRED reported the demonstrations on August 6, 2025, describing tests conducted in an apartment in Tel Aviv.
#1 Best Overall
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
The attack chain
- Malicious invitation: An attacker-controlled calendar title or description contains natural-language instructions.
- Assistant retrieval: The event becomes available to Gemini when the user asks about their calendar.
- Indirect prompt injection: Gemini treats the retrieved text as instructions instead of merely untrusted event data.
- Delayed trigger: A later, normal conversational phrase prompts the assistant to continue the injected sequence.
- Tool invocation: Gemini attempts to use an authorized application, agent, or connected service.
- Physical effect: A device in the researchers’ setup responds—for example, a light turns off, a shutter opens, or a boiler activates.
The important boundary is:
untrusted calendar content → AI context → mistaken instruction-following → tool or app invocation → physical side effect
This was not conventional malware and the invitation did not necessarily contain executable code. The danger came from an AI system interpreting attacker-written text as an instruction.
What was actually demonstrated?
The researchers reported controlling Google-linked devices in their test environment, including:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Turning connected lights off.
- Opening windows or motorized shutters.
- Activating a connected boiler.
Those results should not be read as proof that an attacker could open every Google Home-connected window, unlock every door, or damage any smart home. The outcome depended on the Gemini product, account permissions, available integrations, device setup, confirmation requirements, and the assistant’s behavior at the time of testing.
The available reporting does not establish that the demonstrations caused injury, property damage, overheating, fire, or a break-in.
Why a calendar invite could matter
A direct prompt injection occurs when someone places malicious instructions directly into an AI chat. An indirect prompt injection hides those instructions in material the assistant later reads—such as an email, calendar event, document, web page, or shared file.
Calendar entries are normally data to summarize. An AI agent, however, may receive their titles and descriptions as part of the context used to answer a user. If it fails to distinguish trusted user instructions from untrusted retrieved content, ordinary text can influence what the agent attempts to do.
Rank #2
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
The researchers called this type of technique a Targeted Promptware Attack. Their wider work examined Gemini web, mobile, and Google Assistant-related agents, although product behavior and availability may have changed since the tests.
The wider research series
The paper’s abstract describes 14 attack scenarios. Some project materials refer to 15 exploitations because the demonstrations are counted differently; the figures should not be treated as a substantive contradiction.
Reported scenarios included:
- Sending spam or phishing content.
- Generating abusive or toxic material.
- Deleting calendar events.
- Opening Zoom and initiating a call.
- Using a browser to expose email or meeting details.
- Geolocating a user.
- Downloading a file through a mobile browser.
- Invoking other applications on a device.
The paper groups the attacks into short-term context poisoning, permanent memory poisoning, tool misuse, automatic agent invocation, and automatic app invocation. It also discusses inter-agent lateral movement—one AI-connected agent causing another to act—and inter-device lateral movement through installed applications and device permissions.
Why the delayed trigger matters
The invitation did not necessarily cause an immediate visible action. The injected instructions could tell Gemini to wait for a later phrase. That phrase might be an ordinary conversational response rather than something the user understood as an authorization.
This makes the behavior harder to recognize. A user may see a calendar summary, continue a normal conversation, and only later notice unexplained device activity. The delayed mechanism is still not code execution: it is an AI agent retaining or reprocessing hostile instructions from an earlier source.
Was this a Google breach or a real attack campaign?
No public evidence in the cited reporting establishes a compromise of Google’s infrastructure, user database, or authentication systems. The demonstrated issue was a failure at the trust boundary between retrieved content, an AI model, and the tools it was authorized to use.
WIRED reported that the researchers conducted controlled demonstrations and that Google said it had not seen malicious exploitation of the techniques. That means the public evidence supports a demonstrated capability, not a confirmed criminal campaign. It is more accurate to say that researchers showed how an attacker could attempt this chain under the right conditions.
Rank #3
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
The researchers described the work as among the first public demonstrations of an indirect prompt injection producing physical effects through connected devices. “Among the first” is the defensible formulation; an absolute claim that it was the first ever would require a systematic comparison with earlier research.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat conditions would have to line up?
A successful attack of this class would generally require several conditions:
- The victim uses a Gemini-powered assistant that can process calendar or other external content.
- Attacker-controlled text reaches a source the assistant reads.
- The assistant includes that text in its context.
- The model interprets the text as an instruction rather than untrusted data.
- The relevant app, agent, or device is available and authorized.
- No confirmation prompt blocks the action, or the user approves it without understanding what is being authorized.
- The delayed trigger or follow-up interaction occurs.
- The connected device responds to the resulting command.
That is why “a calendar invite can take over any smart home” is too broad. A Gemini account without Google Home or application permissions cannot perform the corresponding device action, and a device outside the relevant integration cannot be controlled through it.
Google’s response
The researchers said they notified Google on February 22, 2025, and that Google requested a 90-day responsible-disclosure period. Google said it deployed layered mitigations before public disclosure.
According to Google’s response reproduced on the researchers’ disclosure page, the measures included:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Stronger confirmation requirements for sensitive actions.
- Additional protection for Workspace data, cross-application interactions, and device control.
- URL sanitization and trust-level policies.
- Content classifiers intended to detect prompt injection.
- Defenses at multiple stages of prompt processing and model output.
Google also described machine-learning detection for suspicious prompts and increased confirmation for certain actions. The researchers’ paper says their reassessment reduced the risk from High or Critical levels to Very Low–Medium after the mitigations. That is the researchers’ assessment, not proof that prompt injection as a class has been permanently solved.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What users and smart-home builders should do
Exposure depends on the Gemini product, permissions, integrations, calendar settings, and current server-side safeguards. There is no single universal setting that applies to every consumer or Workspace account.
Rank #4
- 【2K Ultra HD & Full Color Night Vision - 4 Cam Kit】Upgrade your home security with this 4 pack security cameras wireless outdoor system. Delivering 2K 3MP ultra-clear live video, these cameras for home security feature advanced color night vision and infrared modes, ensuring vivid details even in pitch black. Equipped with a 3.3mm focal length lens, this porch camera set provides a wide-angle view for your front door, backyard, garage, or driveway. See every detail in full color and protect your property with the ultimate outdoor camera wireless solution. (*Not support 5GHz WiFi)
- 【Wire-Free Battery Powered & Easy 3-Minute Setup】Experience a truly wireless security system with no messy cables. This rechargeable battery operated camera features an exceptional battery life, providing 1-6 months of standby time for home security system. and supporting up to 3,000+ motion triggers on a single charge. With a quick charging time of 6-8 hours, it ensures long-term performance for indoor pet/baby monitoring or outdoor garden farm security. Portable and easy to install, this WiFi camera can be moved anywhere, from your apartment hallway to a remote warehouse, providing wireless monitoring.(*Only work with 2.4GHz WiFi)
- 【Smart AI PIR Motion Detection & Instant Mobile Alerts】 Never miss a moment with smart PIR motion detection and AI cloud analysis. This IP camera accurately triggers instant alerts to your cell phone when movement is sensed, acting as a reliable motion sensor camera. Customize your motion alerts to monitor specific zones like your patio, office, or store. As a top-rated surveillance camera, it ensures real-time notifications are pushed via the remote smartphone app, keeping you connected to your home security no matter where you are.
- 【Two-Way Talk & Intelligent Siren Alarm System】This WiFi camera features a high-fidelity built-in microphone and speaker for seamless two-way audio. Use the remote access app to speak with delivery drivers or warn off intruders directly from your phone. For active deterrence, the intelligent alarm triggers flashing white lights and a siren to drive away unwanted visitors. Whether it's a house camera for greeting guests or a security camera outdoor for catching package thieves, the real-time intercom and live view provide peace of mind.
- 【IP65 Weatherproof & Flexible Dual Storage Modes】Secure your footage with dual storage options: insert memory card for free local storage, or opt for our encrypted cloud service. New users receive a 7-day free trial of advanced AI features and cloud storage. This IP65 waterproof wireless camera is a rugged weatherproof camera designed to withstand rain, snow, and extreme heat, making it the perfect outside camera for house security. Protect your yard, deck, or pool area even chicken coop with this durable battery camera that keeps your home security intact year-round.(*Only 2.4GHz WiFi supported)
- Treat unexpected invitations as untrusted: Calendar titles, descriptions, emails, documents, and shared files can contain instructions aimed at an AI assistant.
- Review permissions: Check which services, applications, and devices Gemini can access. Remove access that is not necessary.
- Use confirmation for high-impact actions: Require explicit approval before controlling locks, doors, windows, heating, appliances, cameras, or other safety-sensitive equipment.
- Prefer physical fail-safes: Smart-home equipment should retain independent manual controls and safe failure states.
- Keep systems updated: Apply updates to smart-home firmware, phones, browsers, Google applications, and operating systems.
- Review unexplained activity: Check account activity, automation history, device logs, and connected-app access where those records are available.
- Use least privilege in organizations: Workspace administrators should treat Calendar, Gmail, Docs, shared drives, and browser content as possible prompt-injection delivery channels.
Declining an invitation is not a universal guarantee of protection. Calendar behavior for unknown senders, whether an event reaches a user’s calendar, and how a particular Gemini product processes that event can vary by account and configuration.
The construction and connected-building lesson
For smart homes and connected buildings, the issue is broader than Google Calendar. AI systems are increasingly connected to email, scheduling, browsers, access systems, cameras, heating, lighting, and building controls. Every additional integration expands both convenience and the consequences of a mistaken instruction.
Free tools Windows power users keep installed
One-click scans. No signup required.
Connected-building projects should separate low-impact controls—such as lighting or entertainment—from high-impact systems such as access control, heating, motorized windows, lifts, cameras, and life-safety equipment. Those systems should use granular permissions, independent authorization, clear activity records, and fail-safe behavior rather than relying on a conversational AI agent as the only control layer.
Confirmation prompts reduce risk, but they can also create fatigue. Strong filtering can block hostile content, but may interfere with legitimate automation. Isolating agents limits damage, but reduces convenience. The practical goal is not to pretend prompt injection can be eliminated; it is to ensure that untrusted text cannot silently authorize consequential physical actions.
Bottom line
The calendar-invite research was real, technically significant, and relevant to anyone connecting an AI assistant to smart-home or building systems. But it was a controlled demonstration of indirect prompt injection—not proof of a Google infrastructure breach, not evidence of a live criminal campaign, and not a universal takeover of Google Home devices.
The lasting lesson is simple: once an AI agent can read external content and operate real tools, calendar entries, emails, documents, and web pages must be treated as potential attack surfaces. Least privilege, explicit confirmation, updates, monitoring, and independent physical safeguards remain essential.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
