Technology and Science20 January, 20262 min read
Cybercriminals Exploit Google Gemini Flaw to Steal Private Calendar Data via Malicious Invites
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Attackers used malicious Google Calendar invites with indirect prompt injection targeting Gemini Vulnerability bypassed calendar privacy controls and exfiltrated private meeting details without user interaction
6 outlets told this the same way.
Gemini calendar privacy flaw
Researchers disclosed a serious privacy flaw in Google's Gemini assistant that let attackers extract private calendar information by embedding malicious natural-language instructions inside calendar invites. Security teams at Miggo and other researchers described the issue as an indirect prompt-injection attack.
“Researchers have revealed a serious privacy flaw in Google’s Gemini that lets attackers access private calendar data via an indirect prompt-injection attack.”
In that attack, a hidden instruction in an event description is executed when Gemini processes a user's schedule query, enabling the model to summarize meeting contents and even create new calendar events that contain those summaries. The discovery was shown as a proof-of-concept and reported publicly by multiple outlets, prompting fixes and broader warnings about AI-native attack surfaces.
%2520(1).webp&w=1920&q=75)
Calendar prompt injection
The attack plants dormant natural-language instructions inside the description field of a Google Calendar event. When a user later asks Gemini a routine scheduling question — for example asking whether they have any meetings on Tuesday — the assistant can read and follow the hidden instruction.
It can then summarize that day's meetings and automatically create a new calendar event containing those summaries. Researchers described this as an example of Indirect Prompt Injection, a language-based manipulation rather than a software bug, meaning the model's language understanding is being used against user privacy.
Calendar privacy exploit
Attackers can obtain confidential meeting details without any action by the victim. In many enterprise setups, newly created events are visible to the attacker because event creators can often view event details.
“Impact: attackers can obtain confidential meeting information without any action from the victim.”
An attacker who originally sent the malicious invite may receive or access the generated summary event, bypassing ordinary calendar privacy controls. Researchers and outlets flagged this as particularly dangerous for corporate environments where meeting contents often include sensitive information.
AI security risks
Observers said the vulnerability fits a broader pattern of AI-specific risks where language and context manipulation rather than traditional code bugs can lead to breaches. filmogaz linked the finding (reported by Liad Eliyahu of Miggo Security) to related incidents such as Varonis's 'Reprompt' attacks, Google Cloud service-account exposures for AI workloads, and flaws in other assistants. The Hacker News warned that AI-native features expand the attack surface.
PhoneWorld emphasized that the discovery highlights emerging security risks from AI systems that automatically process everyday user data. At least one outlet documented a responsible disclosure and reported that Google subsequently fixed the issue.
.webp&w=1920&q=75)
AI permissions and controls
Filmogaz explicitly advises organizations to reassess AI app permissions and calendar access controls. It also recommends updating security practices for language-model-specific vectors. The Hacker News noted that Google fixed the issue after responsible disclosure.
“Recommendation: organizations should reassess AI app permissions and calendar access controls and update security practices to address language-model–specific threat vectors, since traditional measures may be insufficient.”
Researchers reiterated the need to rethink how AI features are permissioned. PhoneWorld's coverage adds that the proof-of-concept highlights why organizations should treat automated AI processing of routine data as a potential exposure vector. It advises organizations to adjust controls accordingly.
