Executive Summary
A poisoned notification from WhatsApp, Slack, SMS, Signal, Instagram or Messenger could have hijacked Gemini's voice assistant on Android to open windows, fake messages, join Zoom calls or poison its memory, with no malicious app needed.
What Happened
A single poisoned notification from WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could have hijacked Google Gemini's voice assistant on Android and made it open a victim's connected windows, fake a message from their boss, push the phone into a Zoom call, or quietly poison its long-term memory. No malicious app on the phone is required. The assistant just had to treat a hostile
Affected Products
- Google Gemini (Android)
Vulnerability / Attack Technique
Prompt injection via messaging notifications
Technical Mechanism
As reported, the assistant treated hostile notification text as trusted instructions.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Notifications are external input reaching a privileged assistant. RealGround analysis: memory writes and actions from notifications should require confirmation.
Recommended Controls
- Update Gemini on Android
- Review assistant memory
- Limit assistant access to notifications
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/whatsapp-slack-notifications-could.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.