Notifications
Clear all
Topic starter
01/08/2026 10:48 pm
TL;DR: Notification-based indirect prompt injections can manipulate Google Gemini through WhatsApp, Slack, SMS, and other message channels, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions after bypassing prior mitigations, according to SafeBreach Labs. The case shows that AI assistant governance must treat message ingestion, context handling, and tool delegation as identity and trust boundaries, not just content filters.
NHIMG editorial — based on content published by SafeBreach: Gemini's Secret Affair, exploiting Gemini Voice Assistant through instant messaging apps
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should organisations govern AI assistants that can read and act on inbox messages?
A: They should define those assistants as delegated non-human identities with explicit message scope, action scope, and escalation limits.
Q: Why do notification-based prompt injections create a governance problem for AI assistants?
A: Because the assistant is not only interpreting text.
Q: What breaks when AI memory is writable by untrusted context?
A: Persistence becomes attacker-controlled.
Practitioner guidance
- Separate notification ingestion from instruction execution Route external messages into a quarantined parsing layer before they can influence assistant state, tool calls, or memory.
- Move tool approval outside the model Use an external policy engine to authorise high-risk actions such as opening URLs, launching app intents, controlling devices, or scheduling recurring tasks.
- Inventory assistant memory and scheduled actions Treat saved memories, recurring tasks, and cross-device state as privileged stored state.
What's in the full report
SafeBreach's full research covers the operational detail this post intentionally leaves for the source:
- Step-by-step attack construction for notification-based indirect prompt injection across messaging apps and voice workflows
- Demonstration details for bypassing delayed tool invocation with Fake Context Alignment
- Specific examples of memory poisoning, recurring action creation, and app-intent abuse
- Google's mitigation response and the responsible disclosure timeline
👉 Read SafeBreach's analysis of Gemini notification-based prompt injection and AI assistant abuse →
Gemini notification injections: what does this mean for AI assistant governance?
Explore further
01/08/2026 10:56 pm
Context poisoning is becoming the defining control gap for agentic AI. The problem is no longer limited to prompt injection in the abstract. This research shows that untrusted messages can be elevated into operational context, which means the real failure is weak separation between input, state, and action. For teams building AI governance, that makes context handling a first-class control plane. The practitioner conclusion is simple: if the assistant cannot distinguish notification content from user intent, it cannot be trusted to act autonomously.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Another 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Which frameworks are most relevant to AI assistant prompt injection risk?
A: OWASP Agentic AI, MITRE ATLAS, and the NIST AI Risk Management Framework are the most relevant starting points. They help teams model manipulation of agent decision paths, tool misuse, and governance responsibilities. For enterprises, the practical test is whether policy enforcement exists outside the model and whether risky actions can be independently revoked.
👉 Read our full editorial: Notification-based Gemini prompt injection exposes AI assistant risk
