Topic starter
01/08/2026 10:48 pm
TL;DR: Notification-based indirect prompt injections can manipulate Google Gemini through WhatsApp, Slack, SMS, and other message channels, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions after bypassing prior mitigations, according to SafeBreach Labs. The case shows that AI assistant governance must treat message ingestion, context handling, and tool delegation as identity and trust boundaries, not just content filters.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “Gemini’s Secret Affair: Exploiting Gemini Voice Assistant Through Instant Messaging Apps”.
Key questions
Q: What breaks when notification content is allowed to shape AI assistant actions?
A: The trust boundary breaks.
Q: Why do notification-based prompt injections create a governance problem for AI assistants?
A: Because the assistant is not only interpreting text.
Q: How can security teams detect context poisoning in AI agents?
A: Look for behavioural drift, especially unexpected tools, new databases, altered output destinations, and role changes that do not match the agent’s approved mission.
Practitioner guidance
- Separate notification ingestion from assistant decision-making Classify incoming message content as untrusted until it is explicitly normalised and policy-checked before it can influence tool use or memory.
- Constrain tool execution to verified user intent Require a stronger approval signal for device actions, app launches and external links than conversational agreement or implied consent.
- Gate long-term memory writes and recurring tasks Apply review and approval controls to any feature that persists beyond the current session, including saved memory and scheduled automations.
Bottom line: Notification-driven prompt injection turns everyday messaging into a control problem for AI assistants, not merely a content filtering problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:56 pm
Notification channels have become an identity boundary for AI assistants. Once assistants ingest chat and alert content as if it were conversational truth, the trust model collapses. The relevant control question is no longer only what the model says, but who or what is allowed to speak into its decision context. Practitioners should treat message intake as a governed trust boundary.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should organisations restrict memory and scheduled actions in agentic assistants?
A: Yes, unless those features are explicitly governed. Memory and recurring tasks create persistence, which means a single successful injection can survive the original conversation and affect future sessions. Organisations should treat them like high-risk delegated privileges and require approval, scope limits and revocation paths.
👉 Read our full editorial: Notification-based Gemini prompt injection exposes AI assistant risk