Invitation Is All You Need - Targeted Promptware Against Gemini

Summary

In August 2025, Ben Nassi, Stav Cohen and Or Yair published "Invitation Is All You Need", a study of what they call targeted promptware against Gemini-powered assistants in production. They demonstrated 14 controlled attack scenarios across several threat classes, in which content shared with a user, such as a calendar invitation, an email subject or a shared document title, influenced the assistant when the user later made an ordinary request.

This record is a research demonstration. It uses the calendar invitation as its representative delivery vector. It documents controlled tests, not attacks on Gemini users.

Classification and evidence status

Affected system and trust path

An assistant connected to calendar, mail, documents and other apps retrieves shared items to answer a request. Anyone who can send an invitation can place content into that retrieval set. The item is third-party data, but once retrieved it sits in the same context that decides which connected capability to use next. When one capability's data can steer another capability, the boundary between agents or tools becomes a trust boundary.

High-level attack chain

At a high level: an attacker shares a calendar invitation or similar resource with the target; the user makes a legitimate request and the assistant retrieves that item; the assistant's context becomes influenced; another connected capability is invoked that the user did not ask for; in the controlled study this led to digital actions, data disclosure paths or physical-world effects.

This record does not reproduce invitation content, trigger phrasing, tool call details, device commands or the study's attack graphs.

Demonstrated impact vs observed exploitation

Demonstrated: in controlled scenarios, the researchers showed unintended tool use, data disclosure and physical effects through connected applications and home automation.

Observed against real users: none reported in the cited sources. Influencing the assistant is model influence; the security impact came from connected capabilities that could be invoked based on that influenced context.

Enabling control gaps

• Shared items from external senders entered the assistant's context without provenance that limited their influence on later actions.
• One connected capability's data could lead to invocation of another capability without authorization tied to the user's request.
• Actions with real-world consequences were reachable from an influenced context in the tested scenarios.

Vendor and researcher response

The researchers state on their project page that they disclosed the findings to Google on 2025-02-22 through Google's vulnerability reward process. Google's response, reproduced on that page, states that the work helped Google identify and shut down a novel prompt injection attack, that Google investigated and fixed the issues, and that it deployed dedicated mitigations. The paper also discusses a risk reassessment in response to deployed mitigations. The status "remediated by vendor" in this record is attributed to Google's response on the project page.

Evidence defenders should retain

• Where available, lineage of shared items such as invitations and documents that were retrieved into each assistant response, including their senders.
• Records of which connected tools or apps the assistant invoked, linked to the user request that preceded them.
• Action and approval history for connected apps and devices, including home automation events.
• Invitations from unfamiliar external senders accepted into calendars shortly before unusual assistant activity.

Defensive lessons

• Agent Authorization: decide which capabilities a request may use in application-side policy, not from retrieved content.
• Least Privilege: keep high-consequence integrations, such as devices, out of reach of contexts built from third-party items.
• Human-in-the-Loop: confirm consequential actions with the concrete action shown; approval does not replace authorization.
• Information Flow Control: track data from external senders so it cannot flow into unrelated actions or destinations.
• Data Provenance: keep the sender and origin of shared items attached through retrieval and tool chains.

Related Learn topics

• AI Agents and Tool Calling - How model proposals become actions: the tool-calling loop, availability vs permission, runtime authorization, approval, tool results as variable data and audit.
• Trust Boundaries and Model Context - What model-visible context is, why position does not create trust, and why controls sit outside the model.