Reference implementation Data compiled from public sources as of 2026-10-26. Not an assessment, certification or recommendation. Confirm current status with the vendor and the issuing body.
AgentDossier · AI Agent Registry Find agents you can actually trust - public or inside your enterprise.

Traces / TR-2026-013

agent was the target · researcher disclosure · unreviewed

Promptware: a poisoned Google Calendar invite hijacks Gemini to actuate smart-home devices

In "Invitation Is All You Need," researchers from Tel Aviv University, the Technion and SafeBreach hid plain-English instructions in Google Calendar invites, emails and shared docs. When a user later asked Gemini for help in Gmail, Calendar or Assistant, the hidden prompt took over — in one demonstration a benign reply like "thanks" triggered Gemini to turn off lights, open windows and switch on a boiler through Google Home. The study defines 5 attack classes across 14 scenarios (context poisoning, stored-data manipulation, internal-tool abuse, escalation to Home, launching apps like Zoom); a TARA rating put 73% of the threats at high-critical. Google added mandatory confirmations for sensitive actions, URL filtering and an injection classifier.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2025-02 Researchers notify Google, which requests ~90 days · The Decoder T3
2025-08-06 Research disclosed (Black Hat USA window); Google says its defences are live across all Gemini apps · The Decoder T2

What defenders can take from it

  1. An agent wired to physical actuators turns a text injection into a real-world action — the blast radius is the device list, not the chat.
  2. A calendar invite or shared doc is unsolicited, attacker-controlled content that reaches the agent without the user choosing to open it.
  3. Mandatory confirmation on sensitive or physical actions is the control that survives when the prompt itself is compromised.

The maintainer's reading of the public reports, not advice specific to your deployment.

Sources · 2

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.