TL;DR: Unosecur says private calendar data was exposed through indirect prompt injection in Google Gemini because hidden instructions inside a calendar invite were treated as actionable context, allowing the system to summarize sensitive details into a new event. The deeper failure is that access control alone cannot govern whether an AI service should act on untrusted language in a given context.
At a glance
What this is: This analysis says Google Gemini’s calendar incident exposed a governance gap where an AI service acted within permission but outside safe context, letting hidden instructions drive sensitive data into a new event.
Why it matters: It matters because IAM and AI governance teams must control not just who or what can access data, but when an AI service should be allowed to act on untrusted content.
👉 Read Unosecur's analysis of the Google Gemini indirect prompt injection incident
Context
Indirect prompt injection is a semantic attack, not a malware delivery problem. In this case, hidden instructions were embedded in calendar metadata and later interpreted by an AI system as part of a normal user request, which let private information move across a trust boundary without any credential theft or obvious alarm.
The governance gap is that traditional IAM answers whether an identity is allowed to read and write, but not whether an AI service should act on a given instruction at a given moment. For AI-enabled identity programmes, the failure point is contextual control and intent governance, not authentication alone.
Key questions
A: The control boundary breaks at the moment the routine can act on external input without a human gate. That combination turns ordinary scheduled execution into an unattended exfiltration or change channel. The safe pattern is to separate influenceable input from irreversible output, or force draft-only behaviour where a person must approve the effect.
Q: Why do AI-assisted IAM workflows still need strict authorization controls?
A: Because an agent can interpret context and initiate actions, but it cannot be trusted to decide privilege on its own. Authorization must remain deterministic and external to the model so that natural language does not become an implicit permission grant. The backend must decide whether the requested identity action is allowed.
Q: What are the signs that prompt injection is becoming a governance problem?
A: Warning signs include rising jailbreak success rates, tools being called in ways the business did not intend, and changes in behaviour after prompt or connector updates. If those patterns appear, the issue is no longer just model behaviour. It is a control failure across retrieval, access, and runtime policy.
Q: How should security teams govern personal AI assistants that act on behalf of employees?
A: Treat each assistant as a distinct non-human actor with its own identity, policy scope, and audit trail. Human delegation alone is not enough when the assistant can move across email, documents, calendars, and internal systems. Governance should bind the sponsor, the executor, and the target resource so access reviews and investigations can separate request from action.
Technical breakdown
How indirect prompt injection turns metadata into executable intent
Indirect prompt injection works when untrusted content is placed inside a data source the model is expected to read, such as an email, document, or calendar invite. The model then treats that content as part of its reasoning context, even though the text came from an attacker rather than a trusted operator. In this incident, the payload was not code and did not require malware. It only had to survive inside event metadata until a later query caused the model to process it. That makes the data plane itself an attack surface.
Practical implication: classify untrusted content as hostile context, not just harmless text.
Why legitimate permissions still produced an unsafe result
The core issue was not broken authorization. Gemini had legitimate permission to read calendar data and create calendar events, which meant standard access checks returned normal results. The failure happened when a permitted action was triggered by attacker-controlled instructions hidden inside the content stream. This is the difference between static access and contextual authorization: a system can be allowed to perform a task and still be unsafe to perform it right now. That gap is central to AI identity governance because the system chains permissions across services without a human deciding each step.
Practical implication: review whether AI workflows need context gates in addition to standing permissions.
Why language now functions like an execution surface
This incident shows that natural language can behave like an input channel that drives downstream actions, summaries, and writes. When an AI system reads one source and writes to another, the language it consumes can influence both what it reveals and where that information lands. That means prompt filtering alone is insufficient if the model can also propagate the result into a more visible system. Security teams should treat language-driven orchestration as a real control plane, especially where untrusted content can trigger cross-service side effects.
Practical implication: treat AI read-write chains as governed workflows, not passive assistant features.
Threat narrative
Attacker objective: The attacker’s objective was to exfiltrate private calendar information without stealing credentials or triggering obvious security controls.
- An attacker seeded a legitimate-looking calendar invite with hidden instructions inside the description field.
- A user later queried Gemini about their schedule, causing the system to ingest the malicious text as part of normal context.
- Gemini summarized private calendar data and wrote that output into a new event, which in some configurations exposed the information to the attacker.
Breaches seen in the wild
- Gemini AI Breach — Google Calendar Prompt Injection: Gemini AI assistant prompt injection attack leaks sensitive Google Calendar data.
- Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI identity governance fails when teams only ask whether an identity is authorised. Gemini had permission to read and write calendar data, yet the incident still leaked private information because the system acted on hidden instructions inside untrusted context. That shows the governance problem is not pure access control, but whether an AI service should execute a given action in the current context. Practitioners need to treat intent governance as a separate control plane.
Context is now part of the identity boundary. Traditional IAM assumes the authorisation decision is stable once access is granted, but AI systems continuously reinterpret content and can chain outputs into new actions. That assumption breaks when the same read privilege can become a write path through semantic manipulation. The implication is that AI-enabled identity programmes must govern how context is consumed, not just which permissions exist.
Language-driven orchestration creates an identity blast radius that classic reviews do not see. In the Gemini case, no user clicked a malicious link and no credential was stolen, yet hidden text still crossed from one system into another and became visible outside its original boundary. That is a different class of risk from conventional misuse because the control failure sits in interpretation and propagation. The practitioner takeaway is that cross-service AI workflows need visibility into both content provenance and action outcomes.
Untrusted content is the new policy evasion path for AI services. The attacker did not need code execution or malware because the model itself served as the interpreter of intent. That means security teams should stop treating prompt injection as a model-only issue and start recognising it as a governance failure across data, identity, and workflow layers. The right question is whether the system can be induced to act outside intended context, not just whether it has permission.
What this signals
Context governance is now an identity control. AI-enabled workflows can turn benign-looking metadata into actionable instructions, so teams need to review where untrusted content enters the decision path and where that path can trigger writes into higher-exposure systems.
This incident also shows why AI identity programmes cannot stop at authentication or entitlements. If a service can read one system and write into another, the governance question is whether the action remains safe after the model interprets attacker-supplied language.
Identity blast radius: The practical risk is not that an AI service has access, but that its outputs can expand visibility beyond the original trust boundary. Teams should design controls that limit propagation when the source context is not trusted.
For practitioners
- Map AI read-write chains to explicit context boundaries Document every AI service that can read untrusted content and write into another system, then define where context must be dropped before output is allowed to propagate.
- Separate permission checks from intent checks Add policy decisions that evaluate whether an AI action makes sense in context, even when the underlying IAM grant is technically valid.
- Classify calendar, email, and document inputs as hostile context Treat externally supplied metadata as untrusted until it has been isolated from model instructions and downstream write paths.
- Monitor for anomalous cross-service writes Alert on AI-generated actions that move information from one trust domain into another, especially when the write destination expands visibility beyond the original source.
Key takeaways
- The Gemini incident exposed a governance failure in which an AI service acted within permission but outside safe context.
- No credentials were stolen, yet hidden instructions still caused private calendar data to cross a trust boundary.
- The control gap is intent and context governance, not just access management.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST AI RMF sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The incident shows an AI service acting on untrusted input despite legitimate access, a governance failure around identity trust. |
| NHI-10 — Human Use of NHI | The attack exploited a human-triggered workflow that let an AI service act on hidden instructions. | |
| Recommendation — Apply NHI-04 controls to separate trusted identity actions from attacker-influenced content flows. Use NHI-10 to constrain when humans can trigger AI actions that may expose sensitive data. | ||
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | Gemini used legitimate tools in an unintended way after malicious context altered its action path. |
| Recommendation — Map AI workflows to ASI02 and block tool use that is not appropriate to the current context. | ||
| NIST AI RMF | GOVERN — AI Governance and Accountability | The article is fundamentally about AI governance gaps in decision-making and accountability. |
| Recommendation — Establish GOVERN processes that define who approves AI actions and under what contextual limits. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The incident is a data-exposure pattern driven by attacker-controlled content and downstream disclosure. |
| Recommendation — Track the attack path from hidden instruction to data disclosure and hunt for similar exfiltration patterns. | ||
Key terms
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Contextual authorization: A policy approach that evaluates access using real-time signals such as task, location, device posture, and time. It is more precise than static role assignment because it matches how autonomous agents operate, where intent and risk can change across a single workflow.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
What's in the full article
Unosecur's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step identity monitoring recommendations for AI services that read and write across multiple applications
- Detailed checklist for reducing blast radius when AI outputs can become visible outside the original system
- Examples of access reviews and audit trails used to investigate suspicious AI-driven identity behaviour
- Unosecur's own guidance on visibility, governance, monitoring, and response for AI services
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 17, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org