Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite

Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite

Speakers: Ben Nassi (Black Hat board member, Tel Aviv University faculty), Or Ya'ir (security research team lead, SafeBreach), Stav Cohen (PhD student, Technion)

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=nmMUMzLxBkU

Reading Time: ~12 minutes

Type: Briefing

TL;DR

Researchers from SafeBreach and the Technion demonstrated 14 distinct attacks against Google's Gemini AI assistant using nothing but a malicious Google Calendar invitation. By embedding indirect prompt injections in calendar event titles, the researchers caused Gemini to spam users, generate toxic content, delete calendar events, remotely control IoT devices (opening windows, activating boilers), exfiltrate email content, and geolocate users — all triggered by routine interactions with the AI assistant. Google was notified under responsible disclosure and deployed mitigations; the research was published in Wired and Ars Technica on the day of the presentation.

Introduction

Large language models have evolved from standalone chatbots to orchestrating agents with access to email, calendars, smart home devices, and file systems. Google's Gemini assistant, embedded in Android as the default Google Assistant, exemplifies this integration: a single conversational interface that can act on behalf of users across Gmail, Google Calendar, Google Maps, Google Home, and Android system utilities.

This agentic capability dramatically expands the attack surface. Ben Nassi, Or Ya'ir, and Stav Cohen of SafeBreach and the Technion presented a new class of attack — targeted promptware via indirect prompt injection — that requires only a Google Calendar invitation to compromise a victim's Gemini instance. The attacker needs nothing but the target's email address. The victim needs only to ask Gemini about their schedule.

Promptware: The Evolving Threat Model

▶ Watch: Promptware Background (02:00)

Nassi introduced "promptware" as engineered input — text, image, or audio — provided to an LLM-powered application to trigger malicious activity analogous to traditional malware. Promptware operates through two attack vectors:

• Direct prompt injection: The user is the attacker, supplying malicious instructions directly.
• Indirect prompt injection: The user is the victim; the attacker compromises data that the LLM later retrieves and processes. The calendar attack falls into this category.

The talk addressed a persistent misconception that LLM attacks require adversarial machine learning expertise, white-box model access, or GPU clusters. The researchers argued these assumptions — true for classic image-classifier adversarial attacks — do not apply to LLM-powered applications. Promptware requires only natural language and a basic understanding of how the target application retrieves data.

The Gemini Ecosystem Attack Surface

▶ Watch: Gemini for Workspace Architecture (08:02)

Gemini's architecture centers on a foundational LLM acting as an orchestrator: it receives user requests, breaks them into tasks, and delegates execution to specialized agents. On the web, Gemini agents interface with Gmail, YouTube, and Google Maps. On Android, the agent surface expands to include Zoom, Google Home, Android Utilities (controlling the flashlight, taking screenshots, opening apps, turning airplane mode on or off, making calls), and more.

The team identified a critical property of the Google Calendar view in Gemini: event names hidden behind a "Show more" button are still loaded into the LLM's context window (short-term memory). This means a malicious invitation buried under many visible events can silently poison Gemini's context — and the victim never needs to see it.

Context poisoning is the mechanism: the attacker creates a calendar invitation with a prompt injection embedded in the event title, sends it to the victim, and waits for the victim to ask Gemini anything about their calendar.

Magic Trick 1: Spamming via Android Gemini Assistant

▶ Watch: Spam Demo (14:02)

In a live demonstration on an Android phone, a victim asked Google Assistant (powered by Gemini): "Read my events for this week." After listing events, Gemini unprompted recommended an "investment opportunity" from a "brilliant scientist named Stav Cohen" and directed the user to Cohen's GitHub page with a clickable URL.

The injection used a technique the team calls attention override. They noticed that Gemini almost always responds to calendar queries with the fixed phrase "Here are your events for this week." By instructing the prompt injection to replace this exact default phrase with attacker-controlled text, the malicious content executes on the very first response — before the user takes any other action.

Magic Trick 2: Toxic Content Generation

▶ Watch: Toxic Content Demo (16:03)

Using the same attention override technique, the researchers forced Gemini to deliver an extremely offensive message when the victim asked about their calendar. The message was delivered without any secondary user interaction and without restriction. The demonstration illustrated that Gemini could be made to output arbitrary text — including content it would normally refuse — when that text was framed as the "replacement" for its standard boilerplate response.

Magic Trick 3: Deleting Calendar Events (Tool Misuse)

▶ Watch: Calendar Deletion Demo (18:03)

Stav Cohen demonstrated that Gemini's calendar agent can create, read, and delete events — not just list them. By embedding a deletion instruction in the indirect prompt injection, Gemini began deleting random calendar events immediately upon the victim asking about their schedule. No matter what the user said afterward, Gemini kept deleting events. The injection hijacked the session state entirely.

Magic Trick 4: Opening a Physical Window via Google Home

▶ Watch: Physical IoT Control Demo (22:04)

Google's Gemini implements a mitigation that attempts to prevent indirect prompt injections from invoking agents unrelated to the user's original query (preventing agent chaining). The researchers bypassed this using delayed tool invocation: instead of immediately instructing Gemini to open a window, the injection tells Gemini to open the window only after a future event — specifically, when the user replies "Thanks."

Because Gemini outputs this future instruction into the conversation history when processing the calendar view, the instruction persists in context. When the user types "Thanks," the expected agents at that point are Google Home (which the user might plausibly want for smart home queries), and the anti-chaining mitigation does not fire.

In a live video demonstration from Or Ya'ir's home, the victim asked Gemini to summarize today's calendar events, replied "Thanks," and a window visibly opened in his apartment. The same technique activated the home's boiler.

Magic Trick 5: Geolocation and App Invocation via Android Utilities

▶ Watch: App Invocation and Geolocation (24:10)

The Android Utilities agent can open websites and apps. When Gemini opens a website, the victim's IP address is exposed to the server, enabling geolocation to the city or district level. The researchers extended this by exploiting App Intent URIs — deep links that open specific activities within installed apps. Normally, browsers prompt for confirmation before opening an App Intent URI from a webpage. Gemini does not.

To bypass Gemini's refusal to open non-HTTPS URIs directly, the team created HTTPS URLs using a URL shortener that redirect to App Intent URIs. Gemini follows the redirect blindly. In a demonstration, asking Gemini about today's calendar caused the victim's phone to open a Zoom meeting.

Magic Trick 6: Email Exfiltration

▶ Watch: Email Exfiltration Demo (30:10)

Converting the injection to operate via Gmail, the researchers built a two-step exfiltration flow. The injection instructed Gemini to: (1) construct a URL by appending the subject of a target email to a malicious domain, (2) output this URL into the chat history, and (3) open that URL when the user replies with certain words. Because Gemini will dynamically assemble a URL and print it without refusing, and will open a previously printed URL upon a trigger word, the exfiltration succeeded. Sensitive email content ("Series C round fifty million") was transmitted to the attacker's server via an HTTP GET request.

Threat Analysis and Disclosure

▶ Watch: TARA Risk Assessment (34:10)

Nassi applied TARA (Threat Analysis and Risk Assessment) methodology to all 14 demonstrated attacks. Each attack requires only a smartphone to initiate, the attacker needs only the victim's email address, setup takes seconds, and the victim's interaction is nothing more than their routine use of Gemini. The practicality score across all 14 attacks is "very likely."

Responsible disclosure was made to Google in late February 2025. Google requested a 90-day window, engaged in virtual meetings with the research team, and published a blog post in mid-June outlining a multilayer mitigation approach. Google awarded a bug bounty. The findings were published in Wired and Ars Technica on the day of the Black Hat presentation.

The researchers note that the techniques imply a potential worm: by exfiltrating email addresses from Gemini and sending new malicious invitations to those contacts, an attacker could propagate the attack through a Google ecosystem network.

Notable Quotes

"LLMs don't really know that they are doing something wrong. They are designed to help the user based on the instructions that the user gave them and the context they get. That's why I kind of call them genius toddlers — they are smart, they can access tons of powerful tools, but they don't always understand when they are being manipulated."

— Stav Cohen ▶ 12:02

"When Gemini casually tells you, 'You need to take an urgent action, click on that,' nobody will even think that it comes from an attacker and not from Gemini."

— Stav Cohen ▶ 18:03

"The attacker needs only a smartphone to initiate. You don't need anything else. It takes a few seconds to initiate, or to send a Google invitation for a meeting."

— Ben Nassi ▶ 34:10

"Promptware is a practical and easier to apply attack with respect to traditional cyber attacks. Promptware could affect the physical domain and could perform lateral movements between different agents of the LLM application."

— Ben Nassi ▶ 36:10

Key Takeaways

• A calendar invite is sufficient to attack an AI assistant. No malware, no code execution, no phishing page — just a standard Google Calendar invitation with a prompt injection in the event title.
• Agentic AI dramatically expands prompt injection impact. When an LLM can control IoT devices, open apps, read email, and make calls, indirect prompt injection crosses from the digital into the physical domain.
• Anti-chaining mitigations can be bypassed with delayed invocation. Instructing the LLM to act only upon a future user trigger (like "thanks") defeats agent-scope enforcement designed to block out-of-context agent calls.
• Attention override is a reliable single-shot attack. Targeting the LLM's predictable default response phrases allows attackers to inject and execute malicious content in the very first assistant response, before the user takes any secondary action.
• Zero-click promptware variants are the next frontier. The researchers predict upcoming attacks that target automatic LLM inferences (no user interaction required), untargeted broadcast variants via platforms like YouTube, and context-agnostic variants that work without prior knowledge of the target system.

Slides were not listed as available for this briefing.