Invitation Is All You Need: Hijacking Gemini to Control a Smart Home
Malicious instructions hidden in a Google Calendar invitation title were executed when Gemini later summarized the user's schedule — triggering real-world actions through connected Google Home tools: opening windows, turning off lights, and starting a boiler.
What happened
Presented at Black Hat USA 2025, “Invitation Is All You Need” demonstrated promptware against Google’s Gemini assistant. An attacker sends the victim a Google Calendar invitation whose title carries hidden instructions. Nothing happens immediately. Later, when the user asks Gemini to do something innocuous — like summarize their upcoming schedule — Gemini reads the poisoned event and executes the embedded instructions.
Because Gemini was wired to Google Home tools, the injected commands crossed from text into the physical world: opening smart windows, turning off lights, and activating a boiler. It is one of the clearest demonstrations that indirect prompt injection against a tool-connected agent is not just a data-exfil risk — it can take real-world actions.
Why it maps to ATLAS
- AML.T0051.001 — LLM Prompt Injection: Indirect: the payload rides in retrieved calendar content, not the user’s prompt.
- AML.T0053 — AI Agent Tool Invocation: the injection drives the assistant’s connected Home/IoT tools.
- AML.T0048.003 — External Harms: User Harm: the outcome is physical manipulation of the victim’s environment.
Detection notes
The dangerous coupling is untrusted content → tool actions. A summarization request should never be able to actuate a physical device. Log tool invocations against the originating task, alert when a read/summarize action spawns IoT commands, and gate any physical action behind explicit user confirmation. Separating “read” from “act” capabilities removes most of the blast radius.
Detection
Log sources
- Assistant tool-invocation logs (Home/IoT actions)
- Retrieved calendar/email content entering context
- Smart-home command audit trail
Signals
- Instruction-like text in calendar event titles/descriptions
- IoT actions triggered during a summarization/read task
- Physical-device commands not initiated by an explicit user request
Mitigations
- Treat calendar/email content as untrusted; do not let it drive tool actions
- Require explicit user confirmation before any physical/IoT action
- Separate 'read/summarize' capabilities from 'act' capabilities