Lead story
When Your Notifications Become the Attacker's Keyboard
Imagine a colleague sends you a Slack message. Nothing unusual — it looks like a routine update. But buried inside it is a command, invisible to you, that your phone's AI assistant dutifully reads and executes. That's the gist of a prompt injection flaw disclosed this week in Google Gemini's Android voice assistant, and it's one of the cleaner demonstrations yet of how ambient AI creates entirely new attack surfaces.
Researchers found that a single malicious notification — from WhatsApp, Slack, SMS, Signal, Instagram, or Messenger — could instruct Gemini to take actions on behalf of the victim. The assistant would open windows, draft and send messages impersonating someone the user trusted, push the phone into a Zoom call, or quietly insert poisoned content into Gemini's long-term memory. No malicious app on the device. No permission prompt. Just the AI doing what it was told.
Why this one matters more than a typical injection demo. Previous prompt injection proofs-of-concept generally required the victim to paste attacker-controlled text into the AI themselves, or visit a crafted web page. The notification attack vector is different: the delivery mechanism is one the user has trained themselves to glance at and dismiss. The phone is already listening. Gemini is already watching the notification stream. The attacker's "command" arrives in the same channel as everything else.
The memory poisoning element is especially worth noting. If an attacker can inject a false belief into Gemini's persistent memory — say, a fake HR policy, a fraudulent account number, a spoofed instruction from a boss — that context sticks around and can influence future AI-assisted decisions. It's less "hack the device" and more "hack the AI's worldview."
Google has patched the flaw, but the broader class of vulnerability it represents isn't going away. As voice assistants become more tightly integrated with calendar, email, banking apps, and communication tools, the notification stream becomes an increasingly attractive attack channel. Any AI that reads context from the environment — which is most of them now — faces some version of this problem.
The Australian picture. Gemini's Android integration is rolling out globally, and Android remains the dominant mobile platform in Australia. Australian banks, government agencies, and enterprises deploying Android device fleets — particularly those that have enabled Gemini for productivity — should treat this as a reminder to review what permissions their AI assistants hold. The ACSC's guidance on mobile device management doesn't yet specifically address agentic AI risk, which is a gap worth flagging to IT security teams.
What to watch. This isn't the last notification-channel injection we'll see. As AI assistants extend deeper into enterprise workflows — reading emails, joining calls, summarising documents — attackers will increasingly try to subvert them at the input layer rather than the device layer. The discipline of "prompt injection defence" is still very young, and the tooling to detect it at scale is thinner than most organisations realise.
The patch is out. The class of attack isn't.