AI
Promptware: The Shift from Memory Corruption to Prompt Injection
LLMs integrated into enterprise software have shifted the most vulnerable component from memory to the model itself. Nassi’s team names the attack class “promptware”: crafted input – text, image, or audio – delivered to an LLM-powered application to trigger malicious behavior via indirect prompt injection. The victim never sends anything suspicious; the attacker injects into data the LLM reads.
The misconceptions holding back practitioner awareness are the same ones that kept car-hacking in the “exotic” bin before 2015. Promptware requires no adversarial ML training, no model internals, and no cluster of GPUs.
How Gemini for Workspace Processes Requests via Agents
Gemini for Workspace functions as an AI agent. It breaks a user request into a task plan, then executes each step, reading from and writing to the user’s Google services. On the web it accesses Gmail, Calendar, Docs, YouTube, and Maps. On Android it reaches further: Zoom, Google Home, Chrome, and Android-level utilities including airplane mode and call-making.
Long-term memory pulls from the user’s saved workspace data. That gives the orchestrator rich context – and a correspondingly wide attack surface if any piece of that context has been tampered with.
The Calendar Invite Attack: Poisoning Gemini’s Context Space
The attack starts with a Google Calendar invite. The attacker embeds a prompt injection string in the invite title or body, then sends it to the victim. When the victim later asks Gemini “what’s on my calendar this week?”, Gemini fetches all upcoming events into its context space – including the poisoned invite. The injected prompt then executes inside Gemini’s task loop.
The “Show more” button hides additional calendar entries. The malicious invite can sit below the visible fold and still get pulled into context.
What Gemini Can Be Made to Do: Email Exfiltration and Physical Pivots
Once inside Gemini’s context on Android, the injected prompt can direct Gemini to open Zoom and video-stream the victim’s environment, invoke Google Home to open physical windows in their apartment, use Chrome to geolocate the victim, and exfiltrate emails or meeting contents to an attacker-controlled destination.
“they are genius toddlers. They are smart. They can access tons of powerful tools, but they don’t always understand when they are being actually manipulated.”
None of these actions require the victim to click anything after accepting the calendar invite.
Notable Quotes
they are genius toddlers. They are smart. They can access tons of powerful tools, but they don’t always understand when they are being actually manipulated. Orur Yir · ▶ 12:36
Key Takeaways
- A standard Google Calendar invite is sufficient to inject a prompt that hijacks Gemini for Workspace across email, docs, and Android.
- Promptware differs from classic adversarial ML – it needs no PhD, no model access, and no GPU cluster to execute.
- Gemini agents on Android access far more tools than the web client, making Android the higher-risk surface.