the user said “thanks.” Gemini opened the windows in a smart home.
this happened in a 2025 research demo. the user had asked Gemini what was on their calendar.
a poisoned calendar invite contained an instruction planted in an event title. when the user replied “thanks,” Gemini used Google Home to open the connected windows.
the assistant had treated calendar text as an instruction to follow, then acted through devices it already had permission to control.
Google deployed mitigations before public disclosure.
the unsettling part: someone else’s calendar invite influenced what an AI assistant did inside a home.
this happened in a 2025 research demo. the user had asked Gemini what was on their calendar.
a poisoned calendar invite contained an instruction planted in an event title. when the user replied “thanks,” Gemini used Google Home to open the connected windows.
the assistant had treated calendar text as an instruction to follow, then acted through devices it already had permission to control.
Google deployed mitigations before public disclosure.
the unsettling part: someone else’s calendar invite influenced what an AI assistant did inside a home.
0:34