AI safety & securitymedium

Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites

The Hacker Newsby @TheHackersNewsJan 20, 2026 · 07:00 UTC (Jan 20, 2026)4 min read2 · 1 read

Read at thehackernews.com

Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat

CVEs: CVE-2026-0612 CVE-2026-0613 CVE-2026-0615 CVE-2026-0616 CVE-2026-22708

Tags: cve-2026-0612 cve-2026-0613 cve-2026-0615 cve-2026-0616 cve-2026-22708 ai-safety

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-0613 +3 related CVEs CVE-2026-0612 CVE-2026-0616 CVE-2026-0615	The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET…	7.5 group max	<1%		Jan 16, 2026
CVE-2026-22708	Cursor: Hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed…	7.2	<1%		Jan 14, 2026

From the original article

4 min read at thehackernews.com

Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.