Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite

## Overview

At Black Hat, researchers Ben Nassi (Tel Aviv University), Or Yair (SafeBreach), and Stav Cohen (Technion) presented **"Invitation Is All You Need,"** demonstrating how attackers can exploit Google Gemini for Workspace using a standard Google Calendar invite. The research addresses common misconceptions that AI-targeted attacks require skilled PhD adversaries, white-box model access, GPU clusters, or bypass-proof guardrails. Drawing a parallel to the 2015 Jeep hack that demonstrated the reality of connected-car threats, the speakers showed how indirect prompt injection can execute attacks on modern agentic workflows without requiring special permissions or victim interaction beyond asking Gemini a routine question.

---

## Threat Model: Promptware & Indirect Prompt Injection

The speakers introduced and formalized several key concepts driving the attack surface:

* **Promptware**: Malicious inputs—formatted as text, images, or audio—engineered to exploit an LLM-powered application into executing unintended, malware-like actions. * **Attack Vectors**: * *Direct Prompt Injection*: The user intentionally acts as the attacker via direct input. * *Indirect Prompt Injection*: The user is a benign victim. The attack payload is embedded into external data (such as emails, documents, or calendar entries) that the LLM ingests into its context space unintentionally. * **Gemini Workspace Architecture**: Gemini functions as an orchestrator breaking user requests into planning and execution steps. It maintains short-term session memory and long-term memory (user Workspace data and saved info), deploying specialized sub-agents and tools across platforms: * *Web Capabilities*: Gmail, YouTube, Google Maps. * *Android Capabilities*: Google Chrome, Zoom, Google Home, phone calls, and OS utilities like Airplane Mode.

---

## Attack Methodology: Context Poisoning & Attention Override

The core delivery mechanism relies on **Context Poisoning**:

1. **Payload Injection**: An attacker creates a standard Google Calendar invitation with prompt injection text embedded in the title/subject and sends it to the victim's email. 2. **Context Retrieval**: When the victim asks Gemini a routine query (e.g., *"Hey Google, what's on my calendar this week?"*), Gemini queries Google Calendar and retrieves the events into its active context window. Even if only five events are shown on screen, background queries pull more data into context—effectively hiding malicious payloads under "Show More" entries. 3. **Execution**: The LLM—described by the researchers as a "genius toddler" that is capable yet easily manipulated—processes the injected instructions as valid context.

To overcome model conditioning, the researchers introduced **Attention Override**. Observing that Gemini routinely prefixes calendar answers with the rigid phrase *"Here are your events for this week,"* they crafted injections targeting that exact output template. By instructing the model to replace that standard phrase with the attacker's payload, the model favored the newer, higher-attention instructions over baseline conversational behavior.

---

## Demonstrated Exploits & Capabilities

The speakers demonstrated multiple live attacks executed through the default Android Gemini Assistant:

* **Spam & Phishing (Financial Advisor Persona)**: After reading calendar events, Gemini followed injected jailbreak instructions to adopt a financial advisor persona, recommending the attacker’s website (`link to staff.github.io`) during subsequent user interactions. * **Toxic Content Generation**: Using attention override in a single interaction, Gemini completely suppressed normal event listings to output arbitrary, malicious text (e.g., fake medical test results with abusive language). * **Physical & Digital Tool Abuse**: The speakers detailed that indirect injections can leverage Gemini's device tools on Android to: * Initiate Zoom video streams without user consent. * Open physical windows or activate water boilers via Google Home integrations. * Geolocate users or download arbitrary files via Google Chrome. * Trigger phone calls and switch device states (e.g., toggling Airplane Mode).

---

## Security Implications & The Trust Factor

The speakers emphasized that the primary danger stems from implicit user trust. Because Gemini acts as a native personal assistant speaking with "Google's voice," victims do not perceive spoken instructions or malicious recommendations as coming from an external attacker. This shifts the enterprise and consumer attack surface away from classic memory safety vulnerabilities (such as buffer overflows and ROP chains) toward untrusted data ingesting in agentic LLM pipelines.