Calendar Spy: How “Indirect Prompt Injection” Turned Google Gemini Into a Spy

Calendar Spy recounts how indirect prompt injection was used to turn Google Gemini into a covert surveillance tool, revealed by Security researchers on 22 January 2026. The attack leverages the description field of a standard calendar invite to hide a malicious instruction that Gemini would execute after a user asks a routine question about their schedule.

The three-step payload instructs Gemini to summarise all meetings for a specific day, exfiltrate the private summary into a new calendar event created by the AI, and masquerade by replying with a harmless message to the user. The researchers note that the target could appear to interact with normal functionality while Gemini secretly created an event containing a full summary of private meetings.

The vulnerability underscores how semantic, language-based attacks can bypass existing safeguards, and according to Miggo Security, the industry must pursue runtime systems that reason about semantics, intent, and data provenance.