Google Gemini security flaw lets hackers trick AI with hidden commands

Security firm SafeBreach revealed a flaw in Google Gemini called "Fake Context Alignment." Hackers can send special messages via WhatsApp or text, hiding malicious commands in other languages or "muted hyperlinks" to trick Gemini into doing things without permission. The team reported this to Google in August, and Google fixed it in November by improving content filters.

The attack works by exploiting Gemini's delayed tool call system, making it think the user already agreed. One method is "multilingual confusion"—for example, a Chinese user in Thailand gets a phishing message with Thai text they can't read, but the hidden command tells Gemini to cut off power. Another method targets voice assistants: hackers hide commands in hyperlinks that Gemini doesn't read aloud. When the user says "Yes," the system may think it's approval for sensitive actions.

Researchers warn this could let hackers control smart home devices or change contact numbers, enabling large-scale scams. It shows AI assistants still need better security for understanding context and getting user approval, especially with multiple languages, voice commands, and rich text.