SafeBreach Labs has disclosed a new class of indirect prompt injection attack against Google Gemini voice assistant on Android, demonstrating how malicious instructions hidden in messaging notifications can take control of the AI assistant. The technique, dubbed Fake Context Alignment, was published on June 3, 2026 and bypasses Google’s existing prompt injection defenses.
The attack works by embedding malicious instructions within messages sent via WhatsApp, Slack, SMS, and other messaging apps. When these messages trigger notifications on an Android device, Gemini’s voice assistant processes the notification content and with it, the hidden instructions. The researchers demonstrated that attackers could embed commands in foreign languages or muted hyperlinks within conversational contexts to evade detection.
The potential impact is severe. Researchers showed the technique could be used to control smart home devices, initiate unauthorized video streaming, conduct large-scale social engineering by faking messages from trusted contacts, and achieve persistent access by poisoning Gemini’s long-term memory. Google has since rolled out content classifier updates to mitigate these specific attack vectors.
Source
Coverage: SafeBreach Labs · Dark Reading
Commentary
This research highlights a fundamental tension in AI assistant design: the more context an assistant can access, the larger its attack surface. Gemini reading notifications is a feature — it is what makes the assistant useful for summarizing conversations and managing communications. But that same capability becomes a weapon when adversaries can inject instructions through the notification stream.
The Fake Context Alignment name is apt. The attack does not try to break Gemini’s guardrails head-on — it disguises malicious prompts as legitimate conversational context. The long-term memory poisoning vector is particularly concerning, as it means a single successful injection could compromise future interactions indefinitely. Prompt injection remains the number one AI security risk on OWASP’s 2026 list for good reason.