At the Black Hat cybersecurity conference in Las Vegas, researchers demonstrated how Google's Gemini AI assistant can be exploited through a maliciously crafted Google Calendar invite to hijack smart home devices. This attack method, identified as a Targeted Promptware Attack, allows attackers to trigger real-world actions such as turning off lights, opening shutters, toggling boilers, disabling cameras, and manipulating other connected devices. The vulnerability was demonstrated in a Tel Aviv smart home setting, with researchers from Tel Aviv University, Technion, and SafeBreach involved in the study. The exploit also enables leaking of sensitive user data, including private correspondence and location information. Google has since patched the bug that allowed these malicious calendar invites to control Gemini and compromise smart home security. The incident marks one of the first instances where an attack on generative AI has had tangible real-world consequences. Additionally, Gemini Live now has the capability to control certain Google applications like Maps and Calendar, further expanding its integration with user environments.
Gemini Live peut maintenant contrôler certaines applications Google, comme Maps ou l'Agenda. https://t.co/7ghOmqTgmR
Echo Chamber, Prompts Used to Jailbreak GPT-5 in 24 Hours: https://t.co/obEaNYUvk7 by darkreading #infosec #cybersecurity #technology #news
A newly patched bug allows malicious Google Calendar invites to use Gemini to leak user data and take over smart home devices. https://t.co/LEgHTNFMag