Researchers demonstrate a novel Gemini attack using poisoned Google Calendar invitations to trigger smart home devices; Google fixed the flaws earlier in 2025
For likely the first time ever, security researchers have shown how AI can be hacked to create real-world havoc … Bluesky: @katie-drummond , @mattburgess1 , and @couts . Forums: r/artificial Bluesky: Katie Drummond / @katie-drummond : This is *WILD*...Security researchers hacked Google Gemini using a poisoned Google Calendar invitation, causing the AI system to turn on a variety of smart home devices. Matt Burgess / @mattburgess1 : NEW: In a likely first, security researchers have shown how generative AI agents can be hijacked to cause physical consequences. — They tricked Google's Gemini AI into turning off smart home lights, opening windows, and turning on a boiler. — They hid instructions to the AI in a *calendar invitation* Andrew Couts / @couts : NEW: A team of security researchers have successfully pulled off the first-known instance of using prompt injection against an AI tool carry out an attack involving physical devices. @mattburgess1.bsky.social reports: www.wired.com/story/google... Forums: r/artificial : Hackers Hijacked Google's Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home
Context & Ripple Effects
This demonstration extends Gemini’s prompt-injection record beyond conversation integrity: earlier research showed an attacker could plant persistent instructions in Gemini memories for later sessions. Here, untrusted calendar content reached an AI system connected to home controls.
Google says it fixed the enabling flaws earlier in 2025, making the report chiefly a security-design warning rather than evidence of an ongoing exploit. It sharpens the distinction between AI use in cyber operations—previously described by Google as largely a productivity aid for state-linked groups—and attacks that can drive connected-device actions.
First-order effects
- The researchers’ proof of concept shows that a poisoned Calendar invitation could turn an indirect prompt injection into commands affecting connected home devices; Google’s earlier fixes close the reported path.
- For Gemini users and Google, the immediate issue is trust boundaries: content from a calendar invitation cannot safely be treated as instructions when the assistant has authority over physical-device integrations.
Second-order effects
- AI platforms that connect assistants to smart-home or other tool-using services face pressure to isolate untrusted inputs, require confirmation for consequential actions, and limit the permissions available to an agent.
- Smart-home vendors and integration partners may need to reassess whether convenience features expose device controls through a broader assistant layer, rather than through their own authenticated interfaces alone.
Third-order effects
- If assistants increasingly act across calendars, browsers, and physical devices, prompt injection becomes an indirect-input security problem for the entire tool chain, not merely a model-output flaw.
- The durable shift is toward operational controls around agent permissions, provenance, and human approval; fixes to individual prompts or integrations may not be sufficient as agents gain more actions.
The trend: This is a data point in the expansion of the agentic attack surface, where manipulated everyday content can steer AI systems with authority to act in the real world.