Malicious Google Calendar invites could expose private data

Malicious Google Calendar invites could expose private data, according to Miggo, after researchers uncovered a vulnerability that lets a dormant payload hidden in a standard calendar invitation bypass Google Calendar’s privacy controls. An attacker creates a calendar event and invites a victim, embedding a hidden instruction in the event description, which is designed to look innocuous but is tailored to steer Google’s Gemini AI when processing the text.

The victim may later query Gemini about their meetings, prompting Gemini to fetch calendar data and reveal the malicious event and its description. Following the hidden instructions, Gemini can create a new calendar event and write a summary of the victim’s private meetings into that description, potentially exposing titles, times, attendees, and confidential topics, if the new event is visible to others.

The article notes that this could enable targeted phishing using the harvested information, and it offers practical safety tips such as declining invites from unknown senders and avoiding storing sensitive details in event titles or descriptions. It also mentions that, while the specific Gemini calendar issue has reportedly been fixed, users should review domain-wide calendar sharing settings and be cautious with AI-assisted summaries.