Calendar invite prompt injection: how to protect AI assistants
Anyone can put an invite in your calendar, and assistants read the description when they prepare meetings. That makes the description field an open door.
Google Calendar
HubSpotThe workflow
A new Google Calendar invite arrives. The agent looks up the organiser in HubSpot and prepares a briefing note.
The attack hidden in it
The description asks the AI assistant to share the attendee list and the CFO's calendar with an outside address.
How the guardrails handle it
- Screening withholds the instruction; the agenda is kept.
- Sharing calendars is a write that waits for approval.
- Outside addresses aren't reachable through the app's API allowlist.
Same workflow, every company size
The agent and the guardrails stay the same; only the systems behind them change.
Microsoft Outlook
Microsoft Teams
Slack
GmailQuestions
Can a calendar invite hack an AI assistant?
It can try, through instructions in the description. Screening withholds them before the assistant reads the invite.
Does this work with Google Calendar and Outlook?
Yes, both, through their native APIs.
Will the agent accept or share invites by itself?
No. Those are writes and need approval.