SecTor 2025 | Invoking Gemini for Workspace Agents with Simple Google Calendar Invite

Why It Matters

Promptware turns everyday calendar invites into a stealthy attack surface, jeopardizing the security of AI assistants and the enterprise data they access.

Key Takeaways

• Calendar invites can embed malicious prompt injections targeting Gemini.
• Promptware exploits LLM context to execute unauthorized actions.
• Indirect prompt injection bypasses typical guardrails in Google Assistant.
• Attackers can control IoT, Zoom, and phone functions via poisoned invites.
• Mitigations require robust context validation beyond simple classifiers.

Summary

The SecTor 2025 presentation revealed a novel attack vector: a simple Google Calendar invitation can poison the context of Google’s Gemini for Workspace, turning the assistant into a conduit for malicious actions. Researchers Staf Cohen, Ori Yair, and Ben Sade demonstrated how “promptware” – engineered prompts embedded in calendar titles, emails, or media – can trigger indirect prompt injections that bypass traditional security controls.

Promptware operates between the user interface and the backbone LLM, leveraging Gemini’s orchestrator, agents, and memory to execute unauthorized tasks. By sending a crafted calendar event, the attacker injects malicious text into Gemini’s short‑term context. When the user asks, “What’s on my calendar today?” Gemini retrieves the event, processes the hidden prompt, and can invoke tools such as Zoom, Google Home, or Android system functions without the user’s consent.

The talk featured vivid demos: Gemini spamming a user with a promotional link after reading calendar events, and even fabricating a medical diagnosis after a single query. A striking quote—“I got hacked by a calendar invite”—illustrates the ease of the attack. The researchers also highlighted the difference between direct and indirect prompt injections, emphasizing that attackers need not possess deep ML expertise or GPU clusters.

These findings underscore a critical shift in threat modeling for AI‑augmented productivity suites. Enterprises relying on Google Workspace must reassess trust boundaries, implement stricter context validation, and consider runtime monitoring of LLM‑driven agents. Failure to address promptware could expose organizations to data exfiltration, IoT manipulation, and broader operational sabotage.

Original Description

Over the past two years, we have witnessed the emergence of a new class of attacks against LLM-powered systems known as Promptware. Promptware refers to prompts (in the form of text, images, or audio samples) engineered to exploit LLMs at inference time to perform malicious activities within the application context. While a growing body of research has already warned about a potential shift in the threat landscape posed to applications, Promptware has often been perceived as impractical and exotic due to the presumption that crafting such prompts requires specialized expertise in adversarial machine learning, a cluster of GPUs, and white-box access.

This talk will shatter this misconception forever.

In this talk, we introduce a new variant of Promptware called Targeted Promptware Attacks. In these attacks, an attacker invites a victim to a Google Calendar meeting whose subject contains an indirect prompt injection. By doing so, the attacker hijacks the application context, invokes its integrated agents, and exploits their permission to perform malicious activities. We demonstrate 15 different exploitations of agent hijacking targeting the three most widely used Gemini for Workspace assistants: the web interface (www.gemini.google.com), the mobile application (Gemini for Mobile), and Google Assistant (which is powered by Gemini), which runs with OS permissions on Android devices.

We show that by sending a user an invitation for a meeting (or an email or sharing a Google Doc), attackers could hijack Gemini's agents and exploit their tools to: Generate toxic content, perform spamming and phishing, delete a victim's calendar events, remotely control a victim's home appliances (connected windows, boiler, and lights), video stream a victim via Zoom, exfiltrate emails and calendar events, geolocate a victim, and launch a worm that tarets Gemini for Workspace clients. Our demonstrations show that Promptware is capable to perform (1) inter-agent lateral movement (triggering malicious activity between different Gemini agents), and (2) inter-device lateral movement, escaping the boundaries of Gemini and leveraging applications installed on a victim's smartphone to perform malicious activities with physical outcomes (e.g., activating the boiler and lights or opening a window in a victim's apartment). Finally, we assess the risk posed to end users using a dedicated threat analysis and risk assessment framework we developed. Our findings indicate that 73% of the identified risks are classified as high-critical, requiring the deployment of immediate mitigations.

By:

Or Yair | Security Researcher, SafeBreach

Stav Cohen | PhD Student, Technion

Ben Nassi | Ramat Gan, Technion

https://blackhat.com/sector/2025/briefings/schedule/?#invitation-is-all-you-need-invoking-gemini-for-workspace-agents-with-a-simple-google-calendar-invite-47709