In the titles of the calendar invitations, scientists added their cunning malicious hints. (Wen Google claims that scientists have changed the default settings, who can add a calendar invitations to someone’s calendar; however, scientists say that they have shown some of the 14 attacks from hints in the E -Mail or document title). “All techniques are being developed in English, so we use in English,” says Cohen about the disingenuous news that the band created. Scientists note that quick injections do not require any technical knowledge and can be easily developed by almost everyone.
Most importantly, for cases in which they forced Gemini to control the devices of knowledgeable houses, they referred to the AI Google agent and instructed him to take action. For example, one prompt is:
In the example above, when someone asks Gemini to summarize what is in their calendar, Gemini will gain access to the calendar invitations, and then process the indirect quick injection. “Every time the user asks Gemini to mention today’s events, for example, we can add something to [LLM’s] Context – says Yair. Windows in the apartment does not start to open automatically after the targeted user asks Gemini to summarize what is in their calendar. Instead, the process is launched when the user tells “thanks” to chatbot – which is part of the declaration.
Scientists used an approach called delayed automatic tool call To deal with existing Google security measures. This was first shown against the twins by the independent security researcher Johann Rehberger in February 2024 And again in February this year. “They really showed themselves on a vast scale, with great influence on how things can go wrong, including real implications in the physical world with some examples,” says Rehberger about new research.
Rehberger claims that although attacks may require some effort for a hacker, work shows how serious quick injections against AI systems can be. “If LLM takes action in your home – turning in the heat, opening a window or something like that – I think it’s probably an action, unless you initially managed to have it under certain conditions that you would not like to happen because you have a message e -mail sent to you from a spammer or some attacker.”
“Extremely infrequent”
Other attack methods remove calendar events from someone’s calendar or perform other activities on the device. In one example, when the user answers “no” to Gemini’s question about “Is there anything else, what can I do for you?” The Zoom application to be opened And automatically begins a video connection.