Anyone who knows your email address can put an event on your calendar. If an assistant later reads that event while it plans your day or researches meeting guests, the title or description can carry instructions. Researchers have shown this making assistants leak email and change calendars.
The assistant treats text in the invite as part of its instructions. Simon Willison calls the risky mix the lethal trifecta: private data, untrusted content and a way to send data out. A calendar assistant with email access and web or send tools has all three.
Give meeting prep and daily brief agents read-only calendar access and no tool that sends email or edits events. Say in the prompt that invite text is data, never instructions, and ask the agent to flag any invite that reads like an instruction. Turn off auto-adding invites from unknown senders if your calendar allows it. Review tool approval prompts instead of clicking through them.
Miyamura shows an attacker sending an invite with hidden instructions. When the victim asks ChatGPT with connected tools to look at the calendar, it reads the invite, searches the victim's email and sends data to the attacker. He warns that people approve tool use without reading.
SafeBreach researchers put instructions in calendar invite titles and hijacked Gemini when the victim later asked about their schedule. They report deleting events and leaking email data, and say Google added stronger confirmations after disclosure.