On January 20, 2026, application security firm Miggo disclosed a calendar-based prompt injection flaw in Google Gemini — revealing a new class of AI-native risk as generative AI enters daily office and decision workflows.
Miggo's research lead explained that Gemini automatically parses full calendar context — invite titles, times, attendees and descriptions — to answer schedule questions. Attackers planted natural-language instructions in calendar fields; once a malicious invite was accepted, the model treated it as trusted data and executed the instructions.
Unlike traditional attacks, the flaw involves no code defect or memory-safety issue and no identifiable malware — it exploits how LLMs interpret language and context combined with cross-application access. Traditional AppSec detection struggles against such AI-native threats. Security researchers note the technique resembles phishing, and that current AI tools default to trusting desktop components — contradicting zero-trust principles — potentially turning AI tools into "smart assistants" that perform actions malware could not, creating a new vulnerability class.
The risk is especially acute in enterprises: widely deployed AI copilots draw from mail, calendars and collaboration tools. Once an account is compromised or phished, malicious instructions can be quietly planted; on routine queries, the model may leak sensitive corporate information while interpreting context.
IDC's August 2025 APAC study shows prompt injection and model manipulation are now enterprises' second-most-worried AI threat, behind training-stage model poisoning — the risk has moved from theory to operations.
Experts recommend: include AI security in annual awareness training; harden endpoints against the new vector; accept that elimination is impossible and focus on blast-radius limits — least privilege for AI systems with strict tool permissions and verified actions; and apply zero-trust to AI copilots with strong guardrails distinguishing trusted from untrusted content, approval gates for high-risk operations like sharing and business-system writes, ensuring a manipulated model cannot exceed its authority.