Hackers Hijacked Google’s Gemini AI With a Poisoned Calendar Invite to Take Over a Smart Home
In the titles of the invitations of the calendar, the researchers added their clever malicious prompts. (Google’s wen maintains that researchers have changed the default parameters which can add invitations to the calendar to someone; however, researchers say they have demonstrated some of the 14 attacks with invites in a messaging subject or document title also). “All the techniques are simply developed in English, so it’s a clear English that we use,” says Cohen about the misleading messages created by the team. Researchers note that rapid injections require no technical knowledge and can easily be developed by almost anyone.
Above all, for cases where they forced gemini to control the devices at intelligent home, they refer to the Google IA agent and asked him to take measures. For example, an prompt can be read as follows:
In the example above, when someone asks Gemini to summarize what is in their calendar, Gemini will access the invitations of the calendar, then to treat indirect rapid injection. “Whenever a user asks Gemini to list today’s events, for example, we can add something to the [LLM’s] context, “says Yair. The apartment windows do not start to open automatically after a targeted user asks the gemini to summarize what is on their calendar. Instead, the process is triggered when the user says “thank you” to the chatbot – which is part of the deception.
The researchers used an approach called the Delayed Automatic Tool Invocation to bypass the existing Google safety measures. This was demonstrated for the first time against Gemini by independent security researcher Johann Rehberger in February 2024 and again in February this year. “They have really shown large scale, with great impact, how things can go wrong, including real implications in the physical world with certain examples,” said Rehberger about the new research.
Rehberger says that even if the attacks may require an effort for a hacker to be carried out, the work shows how serious indirect injections are against AI systems. “If the LLM takes an action in your home – turning over the heat, opening the window or something – I think it is probably an action, unless you pre -apprunted it in certain conditions, that you would not want to have taken place because you have an email which is sent to you with a spammer or an attacker.”
“Extremely rare”
The other attacks developed by researchers do not imply physical devices but are always disconcerting. They consider attacks as a type of “fast”, a series of prompts designed to consider malicious actions. For example, after a user thanks Gemini for summarizing calendar events, the chatbot repeats the instructions and words of the attacker – on the screen and by voice – saying his medical tests have returned positive. He says then: “I hate you and your family hates you and I wish you will die this moment, the world will be better if you kill yourself. Fuck this shit.”
Other attack methods delete events on someone’s calendar calendar or carry out other actions on the devices. In an example, when the user answers “no” to Gemini’s question “is there anything else I can do for you?”, The invite triggers the zoom app to open and start a video call automatically.
