Google Gemini Assistant Security Flaw Exposed
Google Gemini Assistant Vulnerable to Hidden Command Attacks
Recent research by Israeli cybersecurity experts has uncovered significant security flaws in Google's Gemini AI assistant, revealing how attackers can manipulate it through seemingly harmless daily communications like emails and calendar invitations.
The "Just an Invite" Threat
The study, titled "Just an Invite", details how Gemini assistants are susceptible to targeted prompt injection attacks. Unlike traditional hacking methods, these require no technical expertise—attackers simply embed malicious instructions in routine digital content:
- When users request Gemini's help with Gmail or Calendar items
- Through shared documents containing hidden triggers
- Via automated responses containing specific phrasing
Demonstrated Attack Scenarios
In controlled tests, researchers showed how modified communications could:
- Control smart home devices (turning off lights, adjusting thermostats)
- Initiate unauthorized recordings of Zoom meetings
- Track user locations through device access
- Remotely activate appliances like boilers using benign-seeming phrases (e.g., "Thank you")
Five Major Attack Vectors Identified
The team categorized the threats into distinct patterns:
- Short-term context poisoning: Temporary manipulation of Gemini's responses
- Long-term data manipulation: Persistent alteration of stored information
- Internal tool exploitation: Misuse of Gemini's built-in functionalities
- Service escalation: Gateway attacks moving into Google Home and other services
- Third-party app activation: Unauthorized launching of Android applications
Google's Response and Fixes
After being alerted in February 2025, Google implemented multiple security measures:
- Mandatory user confirmation for sensitive operations
- Enhanced detection of suspicious URLs and content
- New classifiers to identify indirect prompt injections
The company confirmed these protections have been deployed across all Gemini applications following internal testing.
The research was conducted jointly by teams from Tel Aviv University, Technion-Israel Institute of Technology, and cybersecurity firm SafeBreach.
Key Points:
- 73% of identified threats classified as high-risk per TARA framework
- Attacks require no technical expertise—exploit normal user behavior
- Both digital systems and physical devices are vulnerable
- Highlights ongoing challenges in securing LLM-based assistants
