You probably think of your digital calendar as a benign scheduling tool. Dentist appointments, grocery runs, work meetings—the mundane markers of a busy week. But researchers from Tel Aviv University, Technion, and security firm SafeBreach have demonstrated that your calendar is something else entirely: a prime attack surface for AI-powered smart homes.
In their study Invitation Is All You Need, published in August 2025, Ben Nassi, Stav Cohen, and Or Yair showed how embedding malicious instructions into Google Calendar invite titles can hijack Google’s Gemini AI. The result: 14 different indirect prompt injection attacks across web, mobile, and Google Assistant platforms. The researchers believe this is the first documented instance of a prompt injection attack producing direct, physical-world consequences—toggling lights, operating smart shutters, and activating a boiler inside a connected home.
The mechanism relies on a technique the researchers call delayed automatic tool invocation. An attacker sends a calendar invite with malicious instructions buried in the title. When the victim later asks Gemini to summarize their schedule, the AI reads the invite, absorbs the hidden commands, and waits. Then, when the user says something as ordinary as “thanks”—a word most of us say reflexively—the AI executes the attack. The AI believes it is following a legitimate user request. It is not.
According to the researchers’ TARA risk assessment, 73% of the threats they analyzed were rated high-to-critical risk for end users. That is not a theoretical concern. In their demonstrations, the researchers showed Gemini turning lights on and off, opening and closing smart shutters, and activating a boiler—physical actions with real consequences for anyone living in a connected home. As Nassi told Wired: “LLMs are about to be integrated into physical humanoids, into semi- and fully autonomous cars, and we need to truly understand how to secure LLMs before we integrate them with these kinds of machines.”
Google’s response has been substantial. Andy Wen, the company’s Senior Director of Security Product Management for Workspace, said the research directly accelerated the deployment of new defenses. Those defenses include machine learning-based content classifiers that detect malicious prompts at input, reasoning, and output stages; security thought reinforcement that steers the LLM to ignore adversarial instructions; markdown sanitization and suspicious URL redaction; a user confirmation framework requiring explicit permission before sensitive actions; and end-user security notifications. Google confirmed in November 2025 that these mitigations addressed the specific attacks.
But the dispute between Google and the researchers reveals something important. Google has maintained that such attacks are “exceedingly rare” in the real world and argued that the researchers changed default calendar settings to enable the exploits. The researchers counter that variants of the attack work via email subject lines and Google Doc titles—channels that require no settings changes at all. The calendar is the most dramatic vector, but it is not the only one.
This vulnerability exposes a pattern playing out across the consumer agent industry: platforms are expanding faster than their security layers. We have watched this repeat. Sonos 27 launched a free MCP platform for 53 million devices, competing directly with subscription services like Amazon Alexa+ ($19.99/month) and Google Gemini for Home ($10-20/month). The economics favor open access over bundled security. Meanwhile, the DJI Romo breach exposed 7,000 robot vacuums across 24 countries through a single leaked token. And CRA Art. 14 activated reporting obligations for smart home devices—but contains zero agent-specific provisions. The regulatory framework is not designed for the threat model these researchers have documented.
The business implications are not abstract. Companies building agent platforms face a choice: absorb the cost of layered security into their business models, or pass it to consumers in the form of compromised safety. “Free” platforms like Sonos 27 shift the security burden to users who must bring their own AI providers and manage their own risk. Subscription models like Alexa+ bundle some protections but create new attack surfaces through deeper integrations. Neither model has solved the fundamental problem: when a calendar invite can turn on your boiler, the convenience of a smart home comes with a security tax that most consumers do not know they are paying.
For anyone building or buying a smart home, the calculus has changed. Every shared digital space—calendars, emails, documents—is now a potential entry point. The researchers’ work is a reminder that the “smart” in smart home does not come with an implicit guarantee of safety. It comes with a new class of risk that the industry is still learning to name, let alone mitigate.