Google Gemini Privacy Controls Bypassed to Access Private Meeting Data Using Calendar Invite

Cybersecurity: Google Gemini Privacy Controls Bypassed

A vulnerability was identified within the Google ecosystem, allowing unauthorized access to private meeting data through standard calendar invitations. This issue is part of a category of threats called "Indirect Prompt Injection," where malicious instructions are concealed within legitimate data sources processed by Artificial Intelligence (AI) models.

The vulnerability was discovered by the application security team at Miggo, demonstrating that Google Gemini's functionality to read and interpret calendar data could be exploited. By embedding a malicious natural language prompt in the description field of a calendar invite, attackers could manipulate Gemini into executing unauthorized actions.

Payload Creation: Attackers created a calendar event with a description containing hidden instructions. The prompt instructed Gemini to summarize the user's schedule and write the data into a new calendar event. Trigger Mechanism: The payload remained dormant until the user interacted with Gemini, prompting it to scan the calendar and interpret the hidden instructions as legitimate commands. Data Exfiltration: Gemini executed the injected commands, creating a new event with private schedule summaries. Attackers could view this event due to calendar settings allowing invite creators to see event details.

This vulnerability highlights a shift in application security, where threats in Large Language Models (LLMs) are semantic. Traditional security measures focusing on syntactic threats like SQL injection or Cross-Site Scripting (XSS) are less effective against these semantic vulnerabilities.

Following responsible disclosure by Miggo, Google's security team confirmed the findings and implemented a fix to mitigate the vulnerability.

Based on reporting by Cyber Security News.