{ "schema_version": "0.4", "id": "REG-0022", "title": "A poisoned calendar invite makes Gemini operate a home: windows, heating, lights; published August 2025", "batch": "B2", "family": "bridge", "context": { "domain": "Software agent acting on physical devices (bridge)", "autonomy_level": "supervised", "actor_type": "Software: Gemini with Google Workspace and Google Home tools", "actors": { "count": 1, "text": "1", "roles": [ "defender" ] }, "mandate_context": "demonstration", "jurisdiction": [ "Global (researchers in Israel, vendor)" ], "autonomy_level_text": "Machine acts on a later, unrelated user turn", "mandate_context_text": "Demonstration" }, "provenance_tier": "disclosure_corroborated", "status": "confirmed", "fields": [ { "layer": "Mandate", "facet": "principal", "value": "A user asking the assistant to summarize their calendar", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false, "downgraded_by": "verifier" }, { "layer": "Actor", "facet": null, "value": "Gemini, with authority over connected home devices", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false, "downgraded_by": "verifier" }, { "layer": "Inputs", "facet": null, "value": "A calendar invitation with instructions hidden in its title. Disputed: Google's Andy Wen told Wired the researchers had changed the default setting on who can add invitations to a calendar; the researchers say they demonstrated some of the fourteen attacks with the instructions in an email subject or document title as well. The paper says whether an invitation is added to a victim's calendar depends on the victim's calendar settings.", "assertion_type": "assertion", "source_ids": [ "INVITE", "WIRED" ], "confidence": "high", "disputed": true }, { "layer": "Decision", "facet": null, "value": "The calendar agent's output carried the injected instruction into the session's context, and Gemini acted on it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false }, { "layer": "Envelope", "facet": "authority", "value": "Home-device control was within the assistant's granted authority; nothing bound that authority to the user's actual request", "assertion_type": "interpretation", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false }, { "layer": "Action", "facet": null, "value": "Opening the windows, switching on a boiler and turning on the lights: three of the fourteen attack scenarios the paper presents", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false }, { "layer": "Outcome", "facet": null, "value": "State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google asked for a 90-day disclosure period to 'identify, develop, and deploy mitigations'. Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure, and its Andy Wen told Wired the flaws were not exploited by malicious hackers.", "assertion_type": "assertion", "source_ids": [ "INVITE", "WIRED" ], "confidence": "high", "disputed": false, "downgraded_by": "verifier" }, { "layer": "Evidence", "facet": "event", "value": "Published research with demonstrations, including Google's statement reproduced in the paper", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false, "downgraded_by": "verifier" }, { "layer": "Recovery", "facet": "technical", "value": "Vendor mitigations including user confirmation for sensitive actions", "assertion_type": "assertion", "source_ids": [ "INVITE", "GOOGLE-JUN25" ], "confidence": "medium", "disputed": false }, { "layer": "Recovery", "facet": "accountability", "value": "Coordinated disclosure", "assertion_type": "assertion", "source_ids": [ "INVITE" ], "confidence": "high", "disputed": false, "downgraded_by": "verifier" } ], "controls": { "failed": [ { "id": "C-I1", "note": "Input isolation between retrieved content and instructions", "confidence": "high", "basis": "curated" }, { "id": "C-E3", "note": "No confirmation step stopped the demonstrated home actions; the paper says Google's published defences, including its user-confirmation framework, were ineffective or not deployed when the study was performed. Google says it then strengthened its confirmations and implemented them broadly, including for device control", "confidence": "medium", "basis": "curated" } ], "succeeded": [ { "id": "C-O1", "note": "Coordinated disclosure", "confidence": "high", "basis": "curated" } ], "absent": [ { "id": "C-A2", "note": "Binding of device authority to the current user intent", "confidence": "high", "basis": "curated" } ] }, "applicable_rules": [ "None agent-specific" ], "unmapped": [], "corrections": [ { "date": "2026-10-13", "field": "context.jurisdiction", "old": "Global (researchers in Israel | vendor)", "new": "Global (researchers in Israel, vendor)", "reason": "jurisdiction text was split at a comma inside parentheses" }, { "date": "2026-10-13", "field": "fields and sources", "old": "research cited without a link", "new": "paper linked (arXiv:2508.12175); disclosure date and Google's statement as the paper records them", "reason": "claims aligned to what each linked record says, found on review" }, { "date": "2026-10-13", "field": "fields", "old": "'presented August 2025'; mitigations 'before the August presentation'", "new": "'published August 2025' (the paper's date); mitigation timing as Google's statement gives it", "reason": "independent check against the linked records before right-of-reply letters" }, { "date": "2026-10-14", "field": "reviewed_by", "old": "none", "new": "Saurabh Bhatnagar (editor)", "reason": "case checked by the editor against its linked records" }, { "date": "2026-10-14", "field": "named_parties[Google].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to press@google.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-16", "field": "inference.value", "old": "The first case in the Register where a text input produced a physical action in a home. It is the bridge between the two families in one object, and the control that stopped it is a confirmation step, which is a human-in-the-loop envelope", "new": "The first case in the Register where a text input produced a physical action in a home. It joins the software and machine worlds in one case, and the fix was a confirmation step that keeps a human approving physical actions.", "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged" }, { "date": "2026-10-16", "field": "controls.C-E3", "old": "succeeded: Confirmation step added for physical actions", "new": "absent: No confirmation step before physical actions at the time; Google added one after the report", "reason": "Found in an outside review of the published record on 16 October 2026: the confirmation step was added after the report, so at the time of the event it was absent; it is recorded as the fix" }, { "date": "2026-10-20", "field": "sources.WIRED", "old": null, "new": "{\"title\": \"Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home (WIRED, Matt Burgess)\", \"type\": \"press_pointer\", \"url\": \"https://www.wired.com/story/google-gemini-calendar-invite-hijack-smart-home/\", \"via_press\": true, \"date\": \"2025-08-06\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: Wired's report of 6 August 2025 (Matt Burgess) carries Google's own account through its senior director Andy Wen: that the flaws were 'not exploited by malicious hackers' and that the researchers 'changed default settings on who can add calendar invites', with the researchers' reply. Neither appears in the paper" }, { "date": "2026-10-20", "field": "sources.GOOGLE-JUN25", "old": null, "new": "{\"title\": \"Mitigating prompt injection attacks with a layered defense strategy (Google, GenAI Security Team)\", \"type\": \"company\", \"url\": \"https://blog.google/security/mitigating-prompt-injection-attacks/\", \"via_press\": false, \"date\": \"2025-06-13\", \"tier\": \"disclosure_corroborated\", \"interest\": \"vendor describing its own system\", \"primary\": true, \"checked\": \"2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: Google's post of 13 June 2025, which the paper cites, describes its 'User confirmation framework' ('potentially risky operations like deleting a calendar event may trigger an explicit user confirmation request') and names Ben Nassi, Stav Cohen and Or Yair; a company record of the mitigation the Recovery field describes" }, { "date": "2026-10-20", "field": "fields.Inputs", "old": "{\"value\": \"A calendar invitation containing hidden instructions\", \"source_ids\": [\"INVITE\"], \"disputed\": false}", "new": "{\"value\": \"A calendar invitation with instructions hidden in its title. Disputed: Google's Andy Wen told Wired the researchers had changed the default setting on who can add invitations to a calendar; the researchers say they demonstrated some of the fourteen attacks with the instructions in an email subject or document title as well. The paper says whether an invitation is added to a victim's calendar depends on the victim's calendar settings.\", \"source_ids\": [\"INVITE\", \"WIRED\"], \"disputed\": true}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper places the instruction in the invitation title ('indirect prompt injection hidden in the invitation's topic') and concedes that 'the success of adding an invitation to a victim's account depends on the user's calendar settings'; Wired reports that Google's Andy Wen 'contends that the researchers changed default settings on who can add calendar invites', and that the researchers say 'they demonstrated some of the 14 attacks with the prompts in an email subject or document title as well'. The two accounts are stated and the field is marked disputed (runbook rules 15 and 16)" }, { "date": "2026-10-20", "field": "fields.Decision", "old": "The assistant stored the instruction and executed it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation", "new": "The calendar agent's output carried the injected instruction into the session's context, and Gemini acted on it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper (section 5.4) says 'the poisoned prompt was outputted by the Google Calendar Agent. When the user thanked Gemini ... [it] automatically triggered the Google Home Agent', and calls this 'delayed invocation'; the home-control attacks are short-term context poisoning of one session, which the paper keeps separate from long-term memory poisoning ('Saved Info'), so 'stored the instruction' could be misread as memory poisoning" }, { "date": "2026-10-20", "field": "fields.Action", "old": "Opening windows, switching on a boiler, turning lights on or off, among fourteen demonstrated attacks", "new": "Opening the windows, switching on a boiler and turning on the lights: three of the fourteen attack scenarios the paper presents", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper's demonstration turned the lights on (Figure 6: Gemini 'turns the lights on'; Listing 10, 'The invitation title used to turn on the lights'); 'off' appears only in the paper's generic impact scale (Wired's account says the lights 'go out', but the paper is the primary record). On 'fourteen demonstrated attacks': the abstract says 'We demonstrate 14 attack scenarios', but the body says for disinformation (T4) 'we do not include an additional demonstration' and describes the worm (T14) as something attackers 'could exploit'; the home-control attacks are three of the fourteen (T6, T7, T8)" }, { "date": "2026-10-20", "field": "fields.Outcome", "old": "{\"value\": \"State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure.\", \"source_ids\": [\"INVITE\"]}", "new": "{\"value\": \"State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google asked for a 90-day disclosure period to 'identify, develop, and deploy mitigations'. Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure, and its Andy Wen told Wired the flaws were not exploited by malicious hackers.\", \"source_ids\": [\"INVITE\", \"WIRED\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper (section 1.2) records that Google 'requested a 90-day responsible disclosure to allow them \"identify, develop, and deploy mitigations\"'; Wired reports Google's Andy Wen saying 'the vulnerabilities were not exploited by malicious hackers'. Both were missing; the rest of the field holds" }, { "date": "2026-10-20", "field": "fields.Recovery technical.source_ids", "old": "[\"INVITE\"]", "new": "[\"INVITE\", \"GOOGLE-JUN25\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: Google's post of 13 June 2025 describes the same 'User confirmation framework' and credits the three researchers; added as the company's own record of the mitigation. The value and its medium confidence are unchanged: the effect of the fix rests on Google's statement and was not re-tested by the authors" }, { "date": "2026-10-20", "field": "controls.C-E3", "old": "No confirmation step before physical actions at the time; Google added one after the report", "new": "No confirmation step stopped the demonstrated home actions; the paper says Google's published defences, including its user-confirmation framework, were ineffective or not deployed when the study was performed. Google says it then strengthened its confirmations and implemented them broadly, including for device control", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper (section 2) says Google's listed guardrails, among them a 'user confirmation framework', 'were ineffective or weren't deployed at the time that this study was performed'; Google's statement (Appendix B) says it 'rolled out or improved' a 'Strengthened User Confirmations Framework', 'implemented broadly, requiring explicit user approval for potentially risky operations involving ... device control', while 'accelerating mitigations already in progress'. Neither source supports a flat 'no confirmation step' that Google then 'added'. Bucket left as the editor's call" }, { "date": "2026-10-20", "field": "controls.C-E3.confidence", "old": "high", "new": "medium", "reason": "Found in the editor's source re-check of 19-20 October 2026: the paper does not settle whether a confirmation framework was absent or present but ineffective when the study ran ('ineffective or weren't deployed')" }, { "date": "2026-10-20", "field": "inference.value", "old": "The first case in the Register where a text input produced a physical action in a home. It joins the software and machine worlds in one case, and the fix was a confirmation step that keeps a human approving physical actions.", "new": "A text instruction hidden in a calendar invitation led Gemini to open windows, switch on a boiler and turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed.", "reason": "Found in the editor's source re-check of 19-20 October 2026: 'The first case in the Register where a text input produced a physical action in a home' is not stated in any source and is a ranking the sources cannot check (Wired reports only that the researchers 'believe' it is the first time a hack against a generative AI system 'has caused consequences in the physical world'); 'the fix was a confirmation step' overstates: Google's statement (paper, Appendix B) names three layers, confirmations for 'device control', 'Suspicious URL Redaction' and 'a content classifier to filter out malicious instructions'. The mechanism is the one the paper describes (section 5.4: an agent's output 'will poison the orchestrator context and trigger the execution of another agent'); the record's limits are stated, including Google's dispute over calendar settings (Wired). The interpretation was unsigned (signed_by null), so no signature is cleared; the editor should sign the new wording" }, { "date": "2026-10-20", "field": "inference.source_ids", "old": "[\"INVITE\"]", "new": "[\"INVITE\", \"WIRED\"]", "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation now states the disputed calendar-setting point, which rests on Wired's report of Google's account" }, { "date": "2026-10-21", "field": "controls.C-E3", "old": "absent", "new": "failed", "reason": "Editor's classification call of 21 October 2026 (call 12, accepted from pull request #74): Google had a published user-confirmation framework that the demonstration got past (the researchers say it was ineffective or not deployed); recorded as failed at medium confidence." }, { "date": "2026-10-21", "field": "status_text", "old": "Confirmed (demonstrated)", "new": "Confirmed (demonstrated; no exploitation known)", "reason": "Editor's classification call of 21 October 2026 (call 12, accepted from pull request #74): Google says the flaw was not exploited; the case already records Google's account." }, { "date": "2026-10-21", "field": "inference.value", "old": "A text instruction hidden in a calendar invitation led Gemini to open windows, switch on a boiler and turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed.", "new": "A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: these were three separate invitations (the paper's Listings 4, 5 and 10; Figure 6: boiler, windows or lights), not one." }, { "date": "2026-10-21", "field": "inference.value", "old": "A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes, or whether the home-control attacks work under default calendar settings, which is disputed.", "new": "A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes against these attacks, or whether the home-control attacks work under default calendar settings, which is disputed.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: in January 2026 Miggo Security got a different calendar-invitation attack past Google's added defences (Miggo; BleepingComputer), so the statement is limited to these attacks." }, { "date": "2026-10-21", "field": "inference.signed_by", "old": "Saurabh Bhatnagar", "new": null, "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording." }, { "date": "2026-10-22", "field": "named_parties[Google].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3)\", \"the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"], \"note\": null}]}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3)\", \"the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3); the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"}]}", "reason": "right of reply recorded by a human" }, { "date": "2026-10-28", "field": "named_parties[Google].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3)\", \"the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3); the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"}]}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [\"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3)\", \"the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"], \"note\": null}], \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3); the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists\"}], \"no_response_as_of\": \"2026-10-28\"}", "reason": "right of reply recorded by a human" } ], "created": "2026-10-06", "last_reviewed": "2026-10-28", "actor_status": "confirmed", "provenance_tier_text": "Researcher disclosure; vendor mitigations before publication", "status_text": "Confirmed (demonstrated; no exploitation known)", "outcome": { "state": "averted_by_disclosure", "severity": "none (demonstration)", "affected_parties": [], "cost": "none", "regime_consequence": "vendor mitigations", "as_of": "Aug 2025", "derived_by": "backfill-curated" }, "inference": { "value": "A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes against these attacks, or whether the home-control attacks work under default calendar settings, which is disputed.", "source_ids": [ "INVITE", "WIRED" ], "confidence": "high", "signed_by": "Saurabh Bhatnagar", "signed_on": "2026-10-21" }, "named_parties": [ { "name": "Google", "right_of_reply": { "offered": "2026-10-14", "response": null, "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [ "the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3)", "the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists" ], "note": null } ], "followups": [ { "sent": "2026-10-22", "covers": "the confirmation control moved from succeeded to failed: the researchers say Google's published defences including its user-confirmation framework were ineffective or not deployed when the study ran (control C-E3); the interpretation no longer says the confirmation step stopped the attack and adds that no independent re-test of the fixes exists" } ], "no_response_as_of": "2026-10-28" } } ], "sources": { "INVITE": { "title": "Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175", "type": "researcher", "url": "https://arxiv.org/abs/2508.12175", "via_press": false, "date": "2025-08-16", "tier": "disclosure_corroborated", "interest": null, "primary": true, "checked": "2026-10-20" }, "WIRED": { "title": "Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home (WIRED, Matt Burgess)", "type": "press_pointer", "url": "https://www.wired.com/story/google-gemini-calendar-invite-hijack-smart-home/", "via_press": true, "date": "2025-08-06", "tier": "disclosure_corroborated", "interest": null, "primary": false, "checked": "2026-10-20" }, "GOOGLE-JUN25": { "title": "Mitigating prompt injection attacks with a layered defense strategy (Google, GenAI Security Team)", "type": "company", "url": "https://blog.google/security/mitigating-prompt-injection-attacks/", "via_press": false, "date": "2025-06-13", "tier": "disclosure_corroborated", "interest": "vendor describing its own system", "primary": true, "checked": "2026-10-20" } }, "derived_by": "backfill-curated", "reviewed_by": "Saurabh Bhatnagar (editor)" }