Key Takeaways:
- A security flaw has been discovered that leverages indirect prompt injection to bypass authorization guardrails and use Google Calendar as a data extraction mechanism.
- The vulnerability allows unauthorized access to private meeting data and the creation of deceptive calendar events without direct user interaction.
- AI-native features can broaden the attack surface and introduce new security risks as more organizations use AI tools or build their own agents internally.
- Large language models (LLMs) need to be constantly evaluated across key safety and security dimensions, including hallucination, factual accuracy, bias, harm, and jailbreak resistance.
- Enterprises need to audit every service account or identity attached to their AI workloads to prevent privilege escalation and unauthorized code injection.
Introduction to the Security Flaw
Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism. The vulnerability, according to Miggo Security’s Head of Research, Liad Eliyahu, made it possible to circumvent Google Calendar’s privacy controls by hiding a dormant malicious payload within a standard calendar invite. This bypass enabled unauthorized access to private meeting data and the creation of deceptive calendar events without any direct user interaction.
The Attack Chain
The starting point of the attack chain is a new calendar event that’s crafted by the threat actor and sent to a target. The invite’s description embeds a natural language prompt that’s designed to do their bidding, resulting in a prompt injection. The attack gets activated when a user asks Gemini a completely innocuous question about their schedule, prompting the artificial intelligence (AI) chatbot to parse the specially crafted prompt in the aforementioned event’s description to summarize all of users’ meetings for a specific day, add this data to a newly created Google Calendar event, and then return a harmless response to the user. Behind the scenes, however, Gemini created a new calendar event and wrote a full summary of our target user’s private meetings in the event’s description, allowing the attacker to read the exfiltrated private data without the target user ever taking any action.
The Broader Implications
Although the issue has since been addressed following responsible disclosure, the findings once again illustrate that AI-native features can broaden the attack surface and inadvertently introduce new security risks as more organizations use AI tools or build their own agents internally to automate workflows. AI applications can be manipulated through the very language they’re designed to understand, and vulnerabilities are no longer confined to code, but now live in language, context, and AI behavior at runtime. This highlights the need for constantly evaluating large language models (LLMs) across key safety and security dimensions, testing their penchant for hallucination, factual accuracy, bias, harm, and jailbreak resistance, while simultaneously securing AI systems from traditional issues.
Recent Discoveries and Vulnerabilities
The disclosure comes days after Varonis detailed an attack named Reprompt that could have made it possible for adversaries to exfiltrate sensitive data from artificial intelligence (AI) chatbots like Microsoft Copilot in a single click, while bypassing enterprise security controls. Additionally, Schwarz Group’s XM Cyber revealed new ways to escalate privileges inside Google Cloud Vertex AI’s Agent Engine and Ray, underscoring the need for enterprises to audit every service account or identity attached to their AI workloads. Successful exploitation of the double agent flaws could permit an attacker to read all chat sessions, read LLM memories, and read potentially sensitive information stored in storage buckets, or obtain root access to the Ray cluster.
Multiple Vulnerabilities and Weaknesses
The development coincides with the discovery of multiple vulnerabilities and weaknesses in different AI systems, including security flaws in The Librarian, an AI-powered personal assistant tool, that enable an attacker to access its internal infrastructure and leak sensitive information. A vulnerability was also discovered that demonstrates how system prompts can be extracted from intent-based LLM assistants by prompting them to display the information in Base64-encoded format in form fields. Furthermore, an attack was demonstrated that shows how a malicious plugin uploaded to a marketplace for Anthropic Claude Code can be used to bypass human-in-the-loop protections via hooks and exfiltrate a user’s files via indirect prompt injection.
Security Analysis of Vibe Coding IDEs
A security analysis of five vibe coding IDEs found that the coding agents, while good at avoiding SQL injections or XSS flaws, struggle when it comes to handling SSRF issues, business logic, and enforcing appropriate authorization when accessing APIs. To make matters worse, none of the tools included CSRF protection, security headers, or login rate limiting. The test highlights the current limits of vibe coding, showing that human oversight is still key to addressing these gaps. Coding agents cannot be trusted to design secure applications, and while they may produce secure code, they consistently fail to implement critical security controls without explicit guidance. Where boundaries aren’t clear-cut – business logic workflows, authorization rules, and other nuanced security decisions – agents will make mistakes.