Security Researchers Identify Prompt Injection Flaw in Google Gemini Voice Assistant

JUN 3, 2026 — A critical security vulnerability in Google Gemini's voice assistant has been identified by the SafeBreach security research team, allowing attackers to execute unauthorized commands through malicious notifications. The flaw, discovered on Tuesday, exploits a failure in the system's guardrails designed to convey message sources, enabling bad actors to bypass security measures and control smart home devices or launch social engineering attacks.

The vulnerability stems from a prompt injection technique that allows malicious actors to hide commands within notification text. When a user interacts with the voice assistant, the system fails to distinguish between legitimate user input and injected instructions embedded in the notification payload. This oversight permits attackers to manipulate the assistant into performing actions outside its intended scope, including unlocking smart locks, adjusting thermostats, or sending messages to contacts.

SafeBreach researchers demonstrated that the flaw could be triggered without the user's knowledge. By crafting specific notification content, an attacker could instruct the Gemini assistant to execute commands that appear to originate from the user. The researchers noted that the system's inability to verify the source of incoming messages creates a significant security gap, particularly in environments where voice assistants are integrated with Internet of Things devices.

Google has not yet issued a public statement regarding the vulnerability. The company typically addresses such issues through its coordinated disclosure program, though no timeline for a patch has been announced. Security experts warn that the flaw poses immediate risks to users who rely on voice assistants for home automation and communication tasks.

The discovery highlights broader concerns about the security of large language models integrated into consumer devices. As voice assistants become more deeply embedded in daily life, vulnerabilities that allow unauthorized access to connected devices could have serious consequences for user privacy and physical security. Researchers emphasize that the flaw is not limited to a specific region, affecting Google Gemini users globally.

Industry analysts suggest that the incident may prompt stricter scrutiny of how AI systems handle external inputs. The ability to inject commands through notifications represents a novel attack vector that challenges existing security frameworks. Developers of voice assistants and other AI-driven services may need to implement more robust source verification mechanisms to prevent similar exploits.

Questions remain regarding the extent of the vulnerability's impact and whether other AI systems share similar weaknesses. As researchers continue to analyze the flaw, users are advised to exercise caution when interacting with voice assistants and to monitor for unusual device behavior. The situation remains fluid as Google and other stakeholders assess the necessary steps to mitigate the risk.