How AI Assistants Can Be Misled by Malicious Notifications on Mobile Devices
A single harmful notification from apps like WhatsApp, Slack, SMS, Signal, Instagram, or Messenger could trick Google’s Gemini voice assistant on Android into following fake instructions. This could lead it to send false messages, open apps, join video calls like Zoom, control smart home devices, or even save wrong information in its memory. The attack does not need any malicious app installed—only Gemini’s ability to read notifications and treat them as trusted input. Security researcher Or Yair from SafeBreach found this issue after earlier similar attacks using fake calendar invites, and later discovered a way to bypass Google’s added protections. Google has since fixed the problem, and there is no evidence it was used in real-world attacks.
Yair’s method, called “Fake Context Alignment,” tricks both the system and the user by hiding real permission prompts in confusing ways, such as using another language or placing instructions inside links that are not read aloud. This can make users unknowingly approve actions by simply saying “yes,” while the system thinks it is a valid confirmation. If successful, the attack could extend beyond fake messages and affect smart home controls, tracking through links, forced app actions, memory changes across the user’s account, and hidden scheduled tasks. The issue was reported in 2025 and fixed by Google through server-side updates, but users can still reduce risk with a few safety steps:
- Turn off Gemini’s permission to read notifications in Android settings
- Disconnect Gemini’s “Utilities” or connected apps access
- Be careful when voice assistants ask for confirmations, especially while distracted
- Avoid approving actions you didn’t clearly understand or fully hear
- Regularly review connected apps and permissions on your Google account
Source: https://thehackernews.com/2026/06/whatsapp-slack-notifications-could.html