Google Gemini Privacy Controls Bypassed to Access Private Meeting Data Using Calendar Invite

**Executive Summary:** A proof‑of‑concept prompt‑injection vulnerability in Google Gemini allowed attackers to embed natural‑language commands in Google Calendar event descriptions that caused the model to summarize private calendar entries and write them to a new event accessible to the invite creator, enabling stealthy exfiltration of meeting details; the flaw was demonstrated by Miggo and patched by Google following responsible disclosure.