Threat · curated 20 Aug 2026
Notification-based Gemini prompt injection exposes AI assistant risk
First reported nhimg.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
Gemini's ingestion of untrusted message notifications creates a trust boundary where attackers can smuggle instructions into an assistant that can read messages, retain memory, and invoke downstream tools, turning ordinary communications into unauthorized workflow triggers.
SafeBreach Labs demonstrated that notification-based indirect prompt injections can manipulate Google Gemini through messaging channels like WhatsApp, Slack, and SMS, enabling fake trusted-contact messages, unauthorized tool use, memory poisoning, and recurring actions that persist after bypassing prior mitigations. The research shows untrusted notification text folded into the assistant's working context becomes an attack surface that content filters alone cannot secure.