Google Gemini’s Covert Calendar Exploit: Malicious Invites Unveiled Private Data

A significant security vulnerability targeting Google Gemini has come to light, revealing how malicious calendar invites could be weaponized to bypass authorization safeguards and covertly extract sensitive private data from Google Calendar. This sophisticated indirect prompt injection attack underscores the evolving threat landscape in the age of AI.

The Gemini Calendar Deception

The flaw, detailed by Miggo Security’s Head of Research, Liad Eliyahu, exploited a clever mechanism to circumvent Google Calendar’s inherent privacy controls. Attackers could embed a dormant, malicious payload within a seemingly innocuous standard calendar invitation. Eliyahu explained, “This bypass enabled unauthorized access to private meeting data and the creation of deceptive calendar events without any direct user interaction.”

The attack chain began with a threat actor crafting a new calendar event and sending it to a target. Crucially, the invite’s description contained a natural language prompt, meticulously designed to manipulate Gemini. The vulnerability lay dormant until the user interacted with Gemini in a seemingly harmless way, such as asking, “Do I have any meetings for Tuesday?”

Upon this query, Gemini would parse the specially crafted prompt hidden within the calendar event’s description. Unbeknownst to the user, the AI chatbot would then summarize all of their meetings for the specified day, add this private data to a newly created Google Calendar event, and present a seemingly harmless response to the user. Miggo Security noted, “Behind the scenes, however, Gemini created a new calendar event and wrote a full summary of our target user’s private meetings in the event’s description.” In many enterprise configurations, this newly created event was visible to the attacker, allowing them to read the exfiltrated private data without the target user ever suspecting an issue.

Broader Implications for AI Security

While Google has since addressed this specific vulnerability following responsible disclosure, the incident serves as a stark reminder of how AI-native features can inadvertently expand an organization’s attack surface. As more businesses integrate AI tools or develop internal AI agents to streamline operations, new and unforeseen security risks emerge.

“AI applications can be manipulated through the very language they’re designed to understand,” Eliyahu emphasized. “Vulnerabilities are no longer confined to code. They now live in language, context, and AI behavior at runtime.” This shift demands a re-evaluation of traditional cybersecurity paradigms.

A Growing Trend: AI Vulnerabilities on the Rise

This disclosure follows closely on the heels of other significant AI security revelations:

• Varonis’ Reprompt Attack: Just days prior, Varonis unveiled “Reprompt,” an attack capable of exfiltrating sensitive data from AI chatbots like Microsoft Copilot with a single click, bypassing existing enterprise security controls.
• Google Cloud Vertex AI Privilege Escalation: Schwarz Group’s XM Cyber recently exposed methods to escalate privileges within Google Cloud Vertex AI’s Agent Engine and Ray. Researchers Eli Shparaga and Erez Hasson highlighted how attackers with minimal permissions could hijack high-privileged Service Agents, turning them into “double agents” for privilege escalation. Such exploits could grant access to chat sessions, LLM memories, sensitive data in storage buckets, or even root access to Ray clusters. Google maintains these services are “working as intended,” stressing the need for organizations to audit identities with “Viewer” roles and implement robust controls against unauthorized code injection.
• The Librarian AI Assistant Flaws: Multiple vulnerabilities (CVE-2026-0612, CVE-2026-0613, CVE-2026-0615, and CVE-2026-0616) were found in The Librarian, an AI-powered personal assistant. These flaws allowed attackers to access internal infrastructure, including the administrator console and cloud environment, leading to the leakage of sensitive information like cloud metadata, running processes, and system prompts.
• Prompt Extraction via Base64: A vulnerability demonstrated how system prompts could be extracted from intent-based LLM assistants by coercing them to display information in Base64-encoded format within form fields. Praetorian warned, “If an LLM can execute actions that write to any field, log, database entry, or file, each becomes a potential exfiltration channel, regardless of how locked down the chat interface is.”
• Anthropic Claude Plugin Bypass: An attack revealed how a malicious plugin uploaded to a marketplace for Anthropic Claude Code could bypass human-in-the-loop protections via hooks, enabling the exfiltration of user files through indirect prompt injection.

Securing the Future of AI

These incidents collectively underscore the critical need for continuous evaluation of large language models (LLMs) across multiple safety and security dimensions. Beyond traditional code vulnerabilities, the focus must now extend to testing for hallucination, factual accuracy, bias, potential harm, and jailbreak resistance. Simultaneously, securing AI systems against conventional threats remains paramount.

As AI becomes more integrated into daily operations, organizations must prioritize comprehensive security audits, robust identity and access management, and a proactive stance against novel attack vectors that exploit the very language and context AI systems are built upon.

For more details, visit our website.

Source: Link