You have a super-smart robot helper.

You can ask it things like:

That's basically what Google Gemini can do.

But here's the problem:

Sometimes the robot can't tell the difference between your instructions and someone else's hidden instructions.

That's what security researchers at SafeBreach discovered.

Your Robot Has One Big Weakness

Let's pretend your robot helps you sort your mail.

You hand it a birthday card.

The card secretly says:

The robot thinks:

That's the core problem.

The hidden message was never meant for you.

It was aimed at the AI.

This is called prompt injection.

What's a Prompt?

A prompt is simply an instruction you give an AI.

Example:

That's a normal prompt.

A prompt injection is when someone secretly hides another prompt inside something the AI reads.

Like hiding instructions inside:

• an email
• a calendar invite
• a PDF
• a text message
• a web page

The AI accidentally obeys the hidden instructions.

Why Is This So Hard to Fix?

Humans naturally know the difference.

Imagine this message:

Alice says:

Easy.

Now imagine Alice secretly writes:

You immediately know:

Large Language Models (LLMs) don't naturally understand this difference.

To them, everything is just text.

They don't automatically know:

• which text is data
• which text is a command

Researchers have been saying for years:

Now let's see why this matters in the real world.

Think about how many Google apps you use every day.

Maybe you check Gmail for emails, use Google Calendar to remember meetings, save files in Google Drive, write documents in Google Docs, browse with Chrome, or use an Android phone.

Recently, Google started adding Gemini into almost all of these apps.

These days Gemini goes beyond answering questions. It can interact with apps and services you've given it permission to use.

For example, Gemini may be able to:

• Read your emails
• Check your calendar
• Read text message notifications
• Control smart home devices
• Open apps
• Start phone calls or video meetings
• Remember information for future conversations

This makes Gemini much more useful, but it also means there's more at stake if it gets tricked.

Imagine you ask Gemini:

To answer your question, Gemini reads your calendar.

If an attacker has hidden a prompt inside a calendar invitation, Gemini reads both the meeting details and the hidden instructions.

Because Gemini processes everything as text, it may accidentally follow those hidden instructions instead of treating them as ordinary content.

The same thing can happen with an email, a document, or even a text message notification.

You never asked Gemini to follow those instructions.

The attacker did.

But Gemini may not always recognize the difference.

Why a Text Message Can Become Dangerous

Normally, a text message is just something you read.

But Gemini can also read your notifications so it can answer questions like:

If a malicious message contains hidden instructions for Gemini, the assistant reads them too.

That means almost any messaging app could potentially become an entry point, including:

• SMS
• Signal
• Telegram
• DMs on almost any social app

The researchers described this attack surface as "effectively infinite" because attackers aren't limited to emails or websites. They can hide instructions almost anywhere Gemini is allowed to read.

What Could Gemini Be Tricked Into Doing?

Gemini cannot magically hack your phone or break into accounts.

Instead, it can misuse the permissions you've already granted it.

Depending on your settings, a successful prompt injection could cause Gemini to:

• Read or summarize the wrong information
• Open websites or apps
• Start a Zoom meeting
• Control smart home devices, such as lights or thermostats
• Send emails or modify calendar events
• Save incorrect information into its long-term memory
• Show misleading or completely false information to you

In other words, a successful attack gives Gemini no new powers. It just spends the permissions you already granted in ways you never intended.

Didn't Google Fix This?

Yes.

The researchers responsibly reported the vulnerabilities they discovered, and Google has since addressed the specific techniques.

However, prompt injection itself remains an unsolved problem across all AI assistants.

Security researchers have long argued that because large language models process both data and instructions as plain text, there is no perfect way to guarantee they will always ignore malicious instructions hidden inside the content they read.

This means AI companies will likely continue improving their defenses, while attackers continue looking for new ways to bypass them. It's an ongoing game of cat and mouse rather than a problem with a permanent solution.

How Can You Protect Yourself?

Think of Gemini like giving someone access to your house.

The fewer keys they have, the less damage they can do if something goes wrong.

Here are practical ways to reduce risk:

• Hide notification contents on your lock screen so Gemini can't read message text from notifications.
• Disable Gemini in Gmail or Google Workspace if you don't rely on its AI features.
• Limit Gemini's permissions, such as access to your calendar, email, or third-party apps.
• Turn off Gemini's access to Android system controls if you don't need it managing device settings.
• Revoke notification access so Gemini can't read incoming messages from apps.
• Use a different assistant, or disable voice assistants entirely if you rarely use them.
• Be cautious when granting AI assistants new permissions, especially those involving smart-home devices, messaging, or email.

Source: Kaspersky Daily​