A simple ״thank you״ triggered the attack.
In episode 3, Michael Bargury welcomes back Ben Nassi (Tel Aviv University faculty member) to revisit Invitation Is All You Need, his research with Stav Cohen and Or Yair. In their demonstration, a user asked Google Assistant about their calendar, bringing a malicious invitation into the conversation. When they thanked the assistant, the payload ran: opening real windows and switching on a boiler.
Michael and Ben unpack delayed tool invocation: why making an attack wait for a later response can help it evade defenses and trigger actions the user never requested. They debate whether that counts as “zero-click,” what changes when agents run without a user prompting them, and why blocking dangerous actions can also block useful ones.
In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury.
A Zenity Labs podcast, produced by POLDHU
CHAPTERS
00:00 A prompt injection opens real windows
00:47 Ben Nassi and the Dumbledore opener
02:22 Invitation Is All You Need
06:46 Google's response and defenses
10:32 Delayed tool invocation
17:44 CaMeL and the cost of defenses
24:45 Beyond the lethal trifecta
30:07 Zero-click or half-click?
37:58 Black Hat submissions and great talks
50:34 Real World AI Security
Relevant Profiles:
Ben Nassi
https://x.com/ben_nassi
https://www.linkedin.com/in/ben-nassi-phd-68a743115/
Michael Bargury
https://x.com/mbrg0
https://www.linkedin.com/in/michaelbargury/
Stav Cohen
https://x.com/StAJect0r
https://www.linkedin.com/in/staject0r/
Or Yair
https://x.com/oryair1999
https://www.linkedin.com/in/or-yair/
Zenity Labs
https://x.com/zenitysec_labs
https://www.linkedin.com/showcase/zenity-sec-labs/
https://labs.zenity.io/
Mentions:
Johann Rehberger — Delayed Tool Invocation
Credited as the original discoverer of the technique that underpins Ben's conditional prompts work. His blog covers it across multiple posts → embracethered.com: https://embracethered.com/blog/
Simon Willison — "The Lethal Trifecta"
Ben extends it from three conditions to four, adding physical actuation → simonwillison.net: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Charlie Miller and Chris Valasek — Jeep Cherokee Remote Exploitation (DEF CON 23 / Black Hat 2015) → DEF CON talk (YouTube): https://www.youtube.com/watch?v=OobLb1McxnI
The Real World AI Security Conference: https://seclab.stanford.edu/RealWorldAIsec/
Dumbledore - Full name Albus Percival Wulfric Brian Dumbledore, headmaster of Hogwarts School of Witchcraft and Wizardry ;)
Research:
"Invitation Is All You Need" (Gemini zero-click attack, with Stav Cohen and Or Yair)
The core research of this episode. Calendar invite embeds a prompt injection that hijacks Google Assistant, triggers physical IoT control, video streaming, and email exfiltration.
→ Paper site: https://sites.google.com/view/invitation-is-all-you-need/home
→ arXiv preprint: https://arxiv.org/abs/2508.12175
→ SafeBreach writeup: https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/
"Here Comes the AI Worm" / Morris-II (with Stav Cohen and Ron Bitton)
The first AI worm, referenced when Ben discusses how the zero-click term originated. Self-replicating adversarial prompts targeting RAG-based GenAI ecosystems.
→ arXiv: https://arxiv.org/abs/2403.02817
→ Project site: https://sites.google.com/view/compromptmized
CaMeL — "Defeating Prompt Injections by Design" (Google DeepMind + ETH Zurich)
Ben's main criticism: great for single inference, breaks down in multi-turn/agent scenarios. The mitigation Michael asks about.
→ arXiv: https://arxiv.org/abs/2503.18813
→ GitHub: https://github.com/google-research/camel-prompt-injection
→ Simon Willison's analysis: https://simonwillison.net/2025/Apr/11/camel/
"The Promptware Kill Chain" (with Bruce Schneier, Oleg Brodt, Elad Feldman)
Referenced by Michael when asking about canaries and prompt perturbation. Maps prompt injection attacks onto a seven-stage malware kill chain.
→ arXiv: https://arxiv.org/abs/2601.09625
→ Lawfare: https://www.lawfaremedia.org/article/the-promptware-kill-chain
→ Schneier on Security: https://www.schneier.com/essays/archives/2026/02/the-promptware-kill-chain.html
