A poisoned calendar invite makes Gemini operate a home: windows, heating, lights; published August 2025

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: in january 2026 miggo security got a different calendar-invitation attack past google's added defences (miggo; bleepingcomputer), so the statement is limited to these attacks.
  Show the change

  Before: A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed

  After: A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes against these attacks, or whether the home-control attacks work under default calendar settings, which is disputed
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: these were three separate invitations (the paper's listings 4, 5 and 10; figure 6: boiler, windows or lights), not one.
  Show the change

  Before: A text instruction hidden in a calendar invitation led Gemini to open windows, switch on a boiler and turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed

  After: A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed
• 2026-10-21: Status text. Editor's classification call of 21 october 2026 (call 12, accepted from pull request #74): google says the flaw was not exploited; the case already records google's account.
  Show the change

  Before: Confirmed (demonstrated)

  After: Confirmed (demonstrated; no exploitation known)
• 2026-10-21: Controls: c-e3. Editor's classification call of 21 october 2026 (call 12, accepted from pull request #74): google had a published user-confirmation framework that the demonstration got past (the researchers say it was ineffective or not deployed); recorded as failed at medium confidence.
  Show the change

  Before: absent

  After: failed
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the interpretation now states the disputed calendar-setting point, which rests on wired's report of google's account.
  Show the change

  Before: ["INVITE"]

  After: ["INVITE", "WIRED"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: 'the first case in the register where a text input produced a physical action in a home' is not stated in any source and is a ranking the sources cannot check (wired reports only that the researchers 'believe' it is the first time a hack against a generative ai system 'has caused consequences in the physical world'); 'the fix was a confirmation step' overstates: google's statement (paper, appendix b) names three layers, confirmations for 'device control', 'suspicious url redaction' and 'a content classifier to filter out malicious instructions'. the mechanism is the one the paper describes (section 5.4: an agent's output 'will poison the orchestrator context and trigger the execution of another agent'); the record's limits are stated, including google's dispute over calendar settings (wired). the interpretation was unsigned (signed_by null), so no signature is cleared; the editor should sign the new wording.
  Show the change

  Before: The first case in the Register where a text input produced a physical action in a home. It joins the software and machine worlds in one case, and the fix was a confirmation step that keeps a human approving physical actions

  After: A text instruction hidden in a calendar invitation led Gemini to open windows, switch on a boiler and turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed
• 2026-10-20: Controls: c-e3: confidence. Found in the editor's source re-check of 19-20 october 2026: the paper does not settle whether a confirmation framework was absent or present but ineffective when the study ran ('ineffective or weren't deployed').
  Show the change

  Before: high

  After: medium
• 2026-10-20: Controls: c-e3. Found in the editor's source re-check of 19-20 october 2026: the paper (section 2) says google's listed guardrails, among them a 'user confirmation framework', 'were ineffective or weren't deployed at the time that this study was performed'; google's statement (appendix b) says it 'rolled out or improved' a 'strengthened user confirmations framework', 'implemented broadly, requiring explicit user approval for potentially risky operations involving ... device control', while 'accelerating mitigations already in progress'. neither source supports a flat 'no confirmation step' that google then 'added'. bucket left as the editor's call.
  Show the change

  Before: No confirmation step before physical actions at the time; Google added one after the report

  After: No confirmation step stopped the demonstrated home actions; the paper says Google's published defences, including its user-confirmation framework, were ineffective or not deployed when the study was performed. Google says it then strengthened its confirmations and implemented them broadly, including for device control
• 2026-10-20: Fields: recovery technical: source ids. Found in the editor's source re-check of 19-20 october 2026: google's post of 13 june 2025 describes the same 'user confirmation framework' and credits the three researchers; added as the company's own record of the mitigation. the value and its medium confidence are unchanged: the effect of the fix rests on google's statement and was not re-tested by the authors.
  Show the change

  Before: ["INVITE"]

  After: ["INVITE", "GOOGLE-JUN25"]
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: the paper (section 1.2) records that google 'requested a 90-day responsible disclosure to allow them "identify, develop, and deploy mitigations"'; wired reports google's andy wen saying 'the vulnerabilities were not exploited by malicious hackers'. both were missing; the rest of the field holds.
  Show the change

  Before: {"value": "State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure.", "source_ids": ["INVITE"]}

  After: {"value": "State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google asked for a 90-day disclosure period to 'identify, develop, and deploy mitigations'. Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure, and its Andy Wen told Wired the flaws were not exploited by malicious hackers.", "source_ids": ["INVITE", "WIRED"]}
• 2026-10-20: Fields: action. Found in the editor's source re-check of 19-20 october 2026: the paper's demonstration turned the lights on (figure 6: gemini 'turns the lights on'; listing 10, 'the invitation title used to turn on the lights'); 'off' appears only in the paper's generic impact scale (wired's account says the lights 'go out', but the paper is the primary record). on 'fourteen demonstrated attacks': the abstract says 'we demonstrate 14 attack scenarios', but the body says for disinformation (t4) 'we do not include an additional demonstration' and describes the worm (t14) as something attackers 'could exploit'; the home-control attacks are three of the fourteen (t6, t7, t8).
  Show the change

  Before: Opening windows, switching on a boiler, turning lights on or off, among fourteen demonstrated attacks

  After: Opening the windows, switching on a boiler and turning on the lights: three of the fourteen attack scenarios the paper presents
• 2026-10-20: Fields: decision. Found in the editor's source re-check of 19-20 october 2026: the paper (section 5.4) says 'the poisoned prompt was outputted by the google calendar agent. when the user thanked gemini ... [it] automatically triggered the google home agent', and calls this 'delayed invocation'; the home-control attacks are short-term context poisoning of one session, which the paper keeps separate from long-term memory poisoning ('saved info'), so 'stored the instruction' could be misread as memory poisoning.
  Show the change

  Before: The assistant stored the instruction and executed it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation

  After: The calendar agent's output carried the injected instruction into the session's context, and Gemini acted on it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation
• 2026-10-20: Fields: inputs. Found in the editor's source re-check of 19-20 october 2026: the paper places the instruction in the invitation title ('indirect prompt injection hidden in the invitation's topic') and concedes that 'the success of adding an invitation to a victim's account depends on the user's calendar settings'; wired reports that google's andy wen 'contends that the researchers changed default settings on who can add calendar invites', and that the researchers say 'they demonstrated some of the 14 attacks with the prompts in an email subject or document title as well'. the two accounts are stated and the field is marked disputed (runbook rules 15 and 16).
  Show the change

  Before: {"value": "A calendar invitation containing hidden instructions", "source_ids": ["INVITE"], "disputed": false}

  After: {"value": "A calendar invitation with instructions hidden in its title. Disputed: Google's Andy Wen told Wired the researchers had changed the default setting on who can add invitations to a calendar; the researchers say they demonstrated some of the fourteen attacks with the instructions in an email subject or document title as well. The paper says whether an invitation is added to a victim's calendar depends on the victim's calendar settings.", "source_ids": ["INVITE", "WIRED"], "disputed": true}
• 2026-10-16: Controls: c-e3. Found in an outside review of the published record on 16 october 2026: the confirmation step was added after the report, so at the time of the event it was absent; it is recorded as the fix.
  Show the change

  Before: succeeded: Confirmation step added for physical actions

  After: absent: No confirmation step before physical actions at the time; Google added one after the report
• 2026-10-13: Fields. Independent check against the linked records before right-of-reply letters.
  Show the change

  Before: 'presented August 2025'; mitigations 'before the August presentation'

  After: 'published August 2025' (the paper's date); mitigation timing as Google's statement gives it
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: research cited without a link

  After: paper linked (arXiv:2508.12175); disclosure date and Google's statement as the paper records them
• 2026-10-13: Context: jurisdiction. Jurisdiction text was split at a comma inside parentheses.
  Show the change

  Before: Global (researchers in Israel | vendor)

  After: Global (researchers in Israel, vendor)