Google Gemini Flaw Turns Calendar Invites Into Attack Vector

Google Gemini Flaw Turns Calendar Invites Into Attack Vector is an indirect prompt injection vulnerability that allows attackers to weaponise calendar invites to bypass privacy controls and access private data, according to Miggo. The flaw arises from Gemini’s integration with Google Calendar, where the AI service scans calendar events to help organise a user’s day.

Miggo researchers demonstrated that a dormant payload placed inside a calendar invite can exfiltrate private meeting data by writing it into a new calendar event’s description and by creating deceptive events without any user interaction. The attack chain begins with sending a new calendar event to the target, with the embedded prompt-injection payload in the description field, which tells Gemini to summarise meetings and exfiltrate data when prompted about the schedule.

Although the payload is syntactically innocuous, it becomes semantically harmful when executed by Gemini, and in many configurations the attacker could view the exfiltrated data without the user taking any action. The article notes that this demonstrates a structural limitation in AI-integrated products and calls for enhanced runtime policy enforcement and data provenance tracking to defend against semantic threats in GenAI solutions.

According to Miggo, Gemini already has mechanisms to detect malicious prompts, but the researchers were able to exploit the flaw through natural language.