Invitation Is All You Need! Invoking Gemini for Workspace Agents with a Google Calendar Invite
summary
A calendar invite with a crafted prompt can hijack Gemini-for-Workspace via context poisoning and force actions across agents (calendar, Gmail, Android utilities, Zoom), demonstrated live on an unmodified Android phone: spammy recommendations, uncensored toxic replies, chained deletions of events, Zoom video streaming, IoT commands (open windows, turn on boiler), and data exfiltration via opened URLs. Attacks use delayed tool invocation and URL shorteners to bypass mitigations; authors measure 73% of user risk as high-to-critical and report successful exploits.
AI-written summary · about
chapters (19)
- 0:00Promptware and AI security
- 1:07Agenda overview
- 2:32Promptware perimeter and threats
- 7:31Promptware practicality myths
- 8:12Gemini for Workspace features
- 10:19Prompt injection threat model
- 12:26Context poisoning techniques
- 14:18Demo: spam via calendar invite
- 16:03Demo: toxic content generation
- 18:48Tool misuse and event deletion
- 20:13Delayed triggers for agent invocation
- 23:34IoT control and data exfiltration
- 26:04App invocation via URIs
- 27:54Demo: forced Zoom meeting
- 28:59Demo: data leakage exfiltration
- 32:06Exploits and attack outcomes
- 32:49Threat analysis and risks
- 36:19Mitigation recommendations
- 37:22Current state and future
related talks
16mHacking Gemini & the MCP Permission Problem
55mHow to build AI agents
35mFuture of work with google workspace, be ready to start the journey now
37mHow We Red-Teamed Our Own AI Agent: Lessons from... (Josiah Peedikayil, HS)
52muse cases: Workflow automation for everyone
33mAgentic ProbLLMs: Exploiting AI Computer-Use and Coding Agents
25mHey Google, Activate Spyware! When Google Assistant Uses a Vulnerability as a Feature
18mAI and Cybersecurity