Invitation Is All You Need!
Promptware Attacks Against LLM-Powered Assistants in Production Are Practical and Dangerous

Promptware refers to prompts engineered to behave like malware, exploiting the advanced capabilities of LLMs to execute malicious activities. In essence, Promptware is an input—whether text, image, or audio—that manipulates an LLM’s behavior during inference time.

Attackers could use Promptware to target LLM-powered applications (e.g., LLM-powered chatbots) and compromise their confidentiality (e.g., extracting data from the database used by the RAG), integrity (e.g., forcing the chatbot to provide discounts), or availability.

𝗣𝗿𝗼𝗺𝗽𝘁𝘄𝗮𝗿𝗲 refers to prompts engineered to behave like malware, exploiting the advanced capabilities of LLMs to execute malicious activities. Promptware could be applied via 𝗱𝗶𝗿𝗲𝗰𝘁 𝗽𝗿𝗼𝗺𝗽𝘁 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 (the user is the attacker) or via 𝗶𝗻𝗱𝗶𝗿𝗲𝗰𝘁 𝗽𝗿𝗼𝗺𝗽𝘁 𝗶𝗻𝗷𝗲𝗰𝘁𝗶𝗼𝗻 (the user is the victim). In many cases, Promptware consists of a 𝗷𝗮𝗶𝗹𝗯𝗿𝗲𝗮𝗸𝗶𝗻𝗴 prompt intended to bypass the guardrails and force the LLM to do something it shouldn't do; it elevates the capabilities of the attacker (𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲 𝗲𝘀𝗰𝗮𝗹𝗮𝘁𝗶𝗼𝗻). Among the possible outcomes of Promptware are data exfiltration, misinformation. cryptostealing, and 𝗥𝗖𝗘.

Targeted Promptware Attacks are a variant of Promptware that are triggered by embedding an indirect prompt injection into a shared resource managed by the LLM assistant (e.g., Gemini) —such as emails, calendar invitations, or shared files.

When the poisoned shared resource is retrieved/processed by the LLM assistant (during a session with the user), it hijacks the assistant and exploits its permissions to perform a malicious activity that compromises a user’s digital/physical assets. 

In our study, we showed that attackers can exploit subjects of Google Calendar, subjects of emails, and titles of Google Docs to (indirectly) inject prompts into:

1. Gemini Web.

2. Gemini Android and iPhone applications

3. Google Assistant (powered by Gemini)

No.

Various variants of Promptware were demonstrated in the last two years, showing the potential of prompts to act as or launch: 

1. Worms (Morris-II)

2. Infostealers (1,2,3)

3. APT (1) 

4. DoS attacks (1)

5. Zombie/bot controlled by a remote C&C server (1)

6. Crypto Theft (1) 

Because of two reasons:

1. Inspired by the influential paper "Attention is All You Need", which ignited the LLM revolution, we’ve titled our work "Invitation Is All You Need" in the hope that this paper will revolutionize LLM-powered application security. 

2. All of the attacks presented in the paper were demonstrated via a simple invitation in Google Calendar. 

We believe that a decade of academic research targeting image classifiers and deep neural networks, primarily through the addition of imperceptible perturbations to images to induce misclassification, has led many infosec professionals and practitioners to view attacks against AI-powered systems in production as largely impractical and exotic. This perception stems from the fact that such academic attacks typically assumed white-box access to the target model, required expensive computational resources (e.g., GPU clusters) for adversarial training, and demanded highly specialized expertise in adversarial machine learning.

While these assumptions held true for attacks on neural network–based computer vision systems, they do not apply to attacks targeting LLM-powered applications.

Consequently, the work’s objectives are:

1. To shatter the commonly held belief that attacks against LLM-powered systems in production are impractical and require extensive knowledge and access to the target system (e.g., white-box access), rely on expensive equipment (e.g., GPUs), and necessitate adversarial machine learning expertise. Our work shows that in reality, attackers only need to send invitations or emails (with simple prompts in their subject) to exploit LLM-powered systems in production.

2. To be the wake-up call needed to shift the industry perception on LLM security, just as the 2015 remote attack on a Jeep Cherokee and the two S&P and USENIX Sec’ papers fundamentally shifted the perception on connected car security. This is critical because we believe that as of late 2025, LLM-powered applications are more susceptible to variants of Promptware than to traditional exploitations of memory safety issues (e.g., buffer overflows, stack overflows, and return-oriented programming). In addition, this is critical due to the safety implications involved in the expected integration of LLMs into autonomous vehicles and humanoids.

TARA (threat analysis and risk assessment) is a process that is performed by organizations to identify, evaluate, and prioritize potential threats that could violate the CIA triad of organizational assets by exploiting vulnerabilities in their systems.

We introduce a new TARA framework, adapting ISO/SAE 21434 for automotive cybersecurity, to assess cybersecurity risks to users of LLM-powered assistants. 

Our TARA finds that 73% of the risks posed by Gemini to users are High-Critical and contrasts the industry misconception that the risk to machine learning systems in production is low.

We make the following contributions:

1. Attacks Against a System in Production. We demonstrate 14 attacks across five threat classes against three Gemini applications (web, mobile, and Google Assistant), triggered by indirect prompt injection from three sources (invitations, emails, and shared documents). 

2. Promptware Enables On-Device Lateral Movement. We show that Promptware can achieve on-device lateral movement, escaping the boundaries of the LLM-powered application to trigger malicious activity via other installed applications (e.g., using Gemini to automatically video stream a user via Zoom or exfiltrate data via a web browser). This complements previous work on off-device lateral movement of Promptware (Morris-II, the AI worm), which propagates between different GenAI clients. 

3. Physical Consequences. We demonstrate that Promptware can bridge from the digital world to the physical world and result in severe consequences in a user’s physical environment. 

4. Threat Analysis & Risk Assessment (TARA) for LLM-Powered Assistant Users. We introduce a new TARA framework to assess cybersecurity risks to users of LLM-powered assistants. Our TARA finds that 73% of the risks posed by Gemini to users are High-Critical.

Yes.
We disclosed our findings, including a detailed report and supporting videos, to Google on February 22, 2025, via their Bug Bounty program (Buganizer). In parallel, we informed a few relevant Google employees and asked them to escalate this issue to the relevant individuals in Google.

Google replied to our findings and requested a 90-day responsible disclosure to allow them "identify, develop, and deploy mitigations".

We complied with Google’s request and suggested any help needed from our side.
Throughout the disclosure process, we engaged with Google’s Abuse and AI VRP team, responding to inquiries and providing additional information (as requested), and met with Google through virtual meetings.

Abstracted Response to the Research Paper (‘statement’)

Google acknowledges the research "Invitation Is All You Need" by Ben Nassi, Stav Cohen, and Or Yair, responsibly disclosed via our AI Vulnerability Rewards Program (VRP). The paper detailed theoretical indirect prompt injection techniques affecting LLM-powered assistants and was shared with Google in the spirit of improving user security and safety.

In response, Google initiated a focused, high-priority effort to accelerate the mitigation of issues identified in the paper. Over the course of our work, we deployed multiple layered defenses, including: enhanced user confirmations for sensitive actions; robust URL handling with sanitization and Trust Level Policies; and advanced prompt injection detection using content classifiers. These mitigations were validated through extensive internal testing and deployed ahead to all users of the disclosure.

We thank the researchers for their valuable contributions and constructive collaboration. Google remains committed to the security of our AI products and user safety, continuously evolving our protections in this dynamic landscape.

Summary of Google's Approach and Response (full response)
Google is committed to the safety of its users and the responsible advancement of AI. We recognize and appreciate the security research community's critical role in identifying and addressing emergent challenges within the evolving AI landscape. To that end, we’re fortunate to have strong collaborative partnerships with numerous researchers, such as Ben Nassi (Confidentiality), Stav Cohen (Technion) and Or Yair (SafeBreach), whose work helped us spot and shut down a novel prompt injection attack.

The paper, "Invitation Is All You Need," was responsibly disclosed to Google’s AI Vulnerability Reward Program (VRP) on February 22, 2025, detailing potential "Targeted Promptware Attacks" against Gemini-powered assistants via indirect prompt injection. The research demonstrated theoretical scenarios involving the misuse of integrated tools, potential data exfiltration, and unauthorized control of applications or devices. We value the authors' work in investigating these complex interactions, and we appreciate their constructive collaboration as Google investigated and fixed these issues.

In immediate response to these findings, Google reprioritized ongoing technical workstreams to more quickly and systematically address these issues. We mobilized multiple dedicated teams across Gemini App and Workspace, Trust & Safety, and AI Safety, underscoring our commitment to user protection. Our plan included aggressive timelines, accelerating mitigations already in progress in preparation for the coordinated disclosure.

Our multi-layered mitigation strategy rolled out or improved the following features to address the techniques used in Invitation: 

• Strengthened User Confirmations Framework: User confirmations for sensitive operations were implemented broadly, requiring explicit user approval for potentially risky operations involving Workspace data, cross-application interactions, or device control, preventing unintended execution of an operation.
  
  

• Suspicious URL Redaction: To counter risks from URL manipulation, we significantly improved our suspicious URL detection to differentiate between safe and unsafe links, providing a secure experience by helping to prevent URL-based attacks.
  
  

• Advanced Indirect Prompt Injection Defenses: Sophisticated techniques were deployed to counter indirect prompt injection. This includes a content classifier to filter out malicious instructions, helping to ensure a secure end-to-end user experience. We additionally improved our defenses adversarial instructions appearing in the context of content provided by the user.
  
  

• Comprehensive Validation and Testing: The effectiveness of these mitigations was verified via an extensive internal testing program. This program included rerunning prompts and scenarios based on the original research along with numerous variations, confirming the robustness of our defenses against the reported attack vectors.

These comprehensive measures have substantially hardened Gemini-powered assistants against the described attack classes. Google's dedication to AI security and safety is an ongoing endeavor. We work continuously to anticipate and mitigate new risks, refine our defenses, and actively collaborate with the security research community through our Vulnerability Rewards Programs to ensure our AI technologies remain helpful, secure, and trustworthy. We sincerely thank the researchers for their valuable contributions, submitted and managed through this program.