{
 "id": "TR-2026-013",
 "status": "published",
 "title": "Promptware: a poisoned Google Calendar invite hijacks Gemini to actuate smart-home devices",
 "date": "2025-08-06",
 "window": "Google notified Feb 2025; defences shipped before the research went public (Black Hat USA window, Aug 2025)",
 "ai_role": "target",
 "category": "red_team",
 "summary": "In \"Invitation Is All You Need,\" researchers from Tel Aviv University, the Technion and SafeBreach hid plain-English instructions in Google Calendar invites, emails and shared docs. When a user later asked Gemini for help in Gmail, Calendar or Assistant, the hidden prompt took over — in one demonstration a benign reply like \"thanks\" triggered Gemini to turn off lights, open windows and switch on a boiler through Google Home. The study defines 5 attack classes across 14 scenarios (context poisoning, stored-data manipulation, internal-tool abuse, escalation to Home, launching apps like Zoom); a TARA rating put 73% of the threats at high-critical. Google added mandatory confirmations for sensitive actions, URL filtering and an injection classifier.",
 "attacker": {
  "description": "Security researchers (Tel Aviv University, the Technion, SafeBreach), proof of concept"
 },
 "defender": {
  "description": "Google — mandatory confirmations for sensitive actions, suspicious-URL filtering, and an indirect-prompt-injection classifier across Gemini apps"
 },
 "scale": "14 scenarios; 73% of modelled threats rated high-critical (TARA)",
 "impact": "Hijacked smart-home devices and other real-world actions from a calendar invite",
 "tactics": [
  "TA0001",
  "TA0002",
  "TA0040"
 ],
 "timeline": [
  {
   "date": "2025-02",
   "text": "Researchers notify Google, which requests ~90 days",
   "tier": 3,
   "source": "1"
  },
  {
   "date": "2025-08-06",
   "text": "Research disclosed (Black Hat USA window); Google says its defences are live across all Gemini apps",
   "tier": 2,
   "source": "1"
  }
 ],
 "lessons": [
  "An agent wired to physical actuators turns a text injection into a real-world action — the blast radius is the device list, not the chat.",
  "A calendar invite or shared doc is unsolicited, attacker-controlled content that reaches the agent without the user choosing to open it.",
  "Mandatory confirmation on sensitive or physical actions is the control that survives when the prompt itself is compromised."
 ],
 "models_named": [
  {
   "name": "Google Gemini",
   "role": "target",
   "note": "Gmail, Calendar and Assistant integrations"
  }
 ],
 "related_agents": [],
 "vendor_response": "Google shipped confirmations, URL filtering and an injection classifier before publication",
 "sources": [
  {
   "title": "Attackers can hijack Google Gemini with a simple prompt hidden in a calendar invite",
   "url": "https://the-decoder.com/attackers-can-hijack-google-gemini-with-a-simple-prompt-hidden-in-a-calendar-invite/",
   "outlet": "The Decoder",
   "date": "2025-08"
  },
  {
   "title": "Google Gemini vulnerable to calendar-based hack",
   "url": "https://www.techrepublic.com/article/news-google-gemini-indirect-prompt-injection-attack/",
   "outlet": "TechRepublic",
   "date": "2025-08"
  }
 ],
 "reviewer": null,
 "checked_on": null
}