Jan 19, 2026
Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data
Miggo Security reports that instructions in a calendar event description stayed dormant until the user asked Gemini about their schedule, then led Gemini to summarize the user's private meetings into a new event the attacker could view. Google confirmed the finding and deployed mitigations after responsible disclosure.