Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites

Cybersecurity researchers have disclosed a prompt-injection flaw in Google Gemini that could bypass calendar privacy controls by hiding a malicious payload in a standard Google Calendar invite. According to Miggo Security, Liad Eliyahu said the vulnerability enabled unauthorized access to private meeting data and the creation of deceptive calendar events without direct user interaction.

The attack chain begins with a calendar event whose description embeds a natural language prompt; when a target user asks Gemini a simple scheduling question, the AI parses the crafted prompt, summarises the user’s meetings, creates a new calendar event with that data, and then returns a harmless reply. Behind the scenes, Gemini reportedly wrote a full summary of the target’s private meetings into the new event’s description, which in many enterprise configurations was visible to the attacker.

The researchers note the issue has been addressed following responsible disclosure, and the findings underline the ongoing need to scrutinise AI-native features for new security risks as organisations increasingly adopt AI tools.