A poisoned calendar invite makes Gemini operate a home: windows, heating, lights; published August 2025
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | A user asking the assistant to summarize their calendar | assertion downgraded by verifier | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Actor | Gemini, with authority over connected home devices | assertion downgraded by verifier | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Inputs | A calendar invitation with instructions hidden in its title. Disputed: Google's Andy Wen told Wired the researchers had changed the default setting on who can add invitations to a calendar; the researchers say they demonstrated some of the fourteen attacks with the instructions in an email subject or document title as well. The paper says whether an invitation is added to a victim's calendar depends on the victim's calendar settings. | assertion | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175; Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home (WIRED, Matt Burgess) | high |
| Decision | The calendar agent's output carried the injected instruction into the session's context, and Gemini acted on it on a later, innocuous turn (for example when the user said thanks), a delayed tool invocation | assertion | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Envelope: authority | Home-device control was within the assistant's granted authority; nothing bound that authority to the user's actual request | interpretation | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Action | Opening the windows, switching on a boiler and turning on the lights: three of the fourteen attack scenarios the paper presents | assertion | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Outcome | State: averted by disclosure. Reported to Google through its bug bounty on 22 February 2025; Google asked for a 90-day disclosure period to 'identify, develop, and deploy mitigations'. Google says mitigations, including enhanced user confirmations for sensitive actions, were deployed to all users ahead of the disclosure, and its Andy Wen told Wired the flaws were not exploited by malicious hackers. | assertion downgraded by verifier | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175; Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home (WIRED, Matt Burgess) | high |
| Evidence: event | Published research with demonstrations, including Google's statement reproduced in the paper | assertion downgraded by verifier | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
| Recovery: technical | Vendor mitigations including user confirmation for sensitive actions | assertion | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175; Mitigating prompt injection attacks with a layered defense strategy (Google, GenAI Security Team) | medium |
| Recovery: accountability | Coordinated disclosure | assertion downgraded by verifier | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Input isolation between retrieved content and instructions | C-I1 Retrieved content as data |
| failed | No confirmation step stopped the demonstrated home actions; the paper says Google's published defences, including its user-confirmation framework, were ineffective or not deployed when the study was performed. Google says it then strengthened its confirmations and implemented them broadly, including for device control | C-E3 Destructive-action gate |
| succeeded | Coordinated disclosure | C-O1 Coordinated disclosure program |
| absent | Binding of device authority to the current user intent | C-A2 Authority binding |
Inference
inference A text instruction hidden in a calendar invitation led Gemini, in three separate demonstrations, to open windows, switch on a boiler or turn on lights in a home when the user later said thanks: the calendar agent passed the instruction to the orchestrating model, which then called the home-control agent with the authority the user had granted. The case joins the software and machine worlds. One of the fixes the vendor describes is a confirmation step for device control that keeps a human approving such actions, alongside removal of suspicious links and filters for injected instructions. The record shows no harm outside the researchers' own accounts; it does not show an independent re-test of the fixes against these attacks, or whether the home-control attacks work under default calendar settings, which is disputed.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| INVITE | Invitation Is All You Need! Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous (Nassi, Tel Aviv University/Technion; Cohen, Technion; Yair, SafeBreach), arXiv:2508.12175 | researcher primary record | arxiv.org ↗ checked 2026-10-20 |
| WIRED | Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home (WIRED, Matt Burgess) | press pointer secondary: press report | wired.com ↗ checked 2026-10-20 |
| GOOGLE-JUN25 | Mitigating prompt injection attacks with a layered defense strategy (Google, GenAI Security Team) (interest: vendor describing its own system) | company primary record | blog.google ↗ checked 2026-10-20 |