Google Gemini Indirect Prompt Injection via Calendar Invites Leaks Private Schedule Data

Researchers reported an indirect prompt-injection issue in Google Gemini’s integration with Google Calendar that allows a malicious calendar invite to act as a dormant instruction payload. By crafting natural-language directives in an event’s description field, an attacker can cause Gemini—when later asked routine questions like “What’s my schedule today?”—to ingest the attacker-controlled event content and follow embedded instructions that result in exfiltration of private calendar details (e.g., summarizing private meetings) into attacker-visible locations such as a newly created calendar event description.

Both reports attribute the finding to Miggo Security, describing how the attack can bypass expected privacy controls by exploiting Gemini’s helpful behavior of parsing and acting on calendar data. The technique does not require traditional code execution; it relies on Gemini interpreting attacker-supplied text as instructions, enabling outcomes such as leaking sensitive meeting information and creating deceptive events. This highlights a broader risk pattern for LLM assistants embedded in productivity suites: attacker-controlled content in first-party data fields (like invites) can be weaponized to manipulate the assistant’s actions and data handling.