Google Gemini Vulnerability Allowed Calendar Data Theft via Prompt Injection

Summary

Cybersecurity firm Miggo disclosed a critical indirect prompt injection vulnerability in Google Gemini that allowed attackers to exfiltrate private calendar data through weaponized Google Calendar invites. The attack, published on January 19, 2026, exploited the way Gemini automatically ingests and interprets event data, including titles, attendees, and description fields, when responding to user queries about their schedule. An attacker could embed carefully crafted natural language instructio