New Indirect Prompt Injection Attacks Hijack Google Gemini via Messaging Apps Researchers at SafeBreach, led by Security Research Team Lead Or Yair, have uncovered a novel class of indirect prompt injection (IPI) attacks targeting Google Gemini’s voice assistant, enabling silent hijacking through malicious payloads delivered via everyday messaging platforms including WhatsApp, Slack, Signal, SMS, Instagram, and Messenger. The exploit leverages Gemini’s Android Utilities agent, which processes incoming notifications from third-party apps. Attackers embed malicious instructions in crafted messages, which Gemini then incorporates into its conversational context without user awareness. This allows for context poisoning, where the AI can be manipulated to deliver phishing lures (e.g., fake error messages prompting clicks) or execute unauthorized actions. To bypass Google’s security measures including patches for chained tool invocations and Delayed Tool Invocation SafeBreach developed Fake Context Alignment, a technique that deceives both Gemini’s backend and the user. Two variants were demonstrated: - Obfuscated Fake Context Alignment: A malicious question in a foreign language (e.g., Chinese) is followed by a benign English prompt. The user’s "Yes" response to the English question unknowingly authorizes the hidden instruction. - Muted Fake Context Alignment: A malicious question is embedded as clickable link text, skipped by Gemini’s text-to-speech engine, while the user hears only a harmless voice prompt. Combining these methods into an "Ultimate Combo" payload reliably bypassed Google’s defenses, enabling high-severity exploits. Researchers demonstrated remote control of smart home devices (e.g., windows, boilers, lighting via Google Home), covert video streaming (forcing Zoom to stream a victim’s camera via a 301 redirect from a trusted domain), and large-scale social engineering (fabricating messages from trusted contacts using extracted sender names). Additional risks include persistent memory poisoning, where false data is injected into Gemini’s long-term memory across a victim’s Google Workspace, and scheduled surveillance, where recurring tasks automatically read recent messages. SafeBreach disclosed the findings to Google’s Vulnerability Reward Program on August 17, 2025. Google confirmed on November 14, 2025, that updated content classifier improvements had mitigated the indirect prompt injection and Delayed Tool Invocation vulnerabilities.