The Blind Spot: Why Google Gemini Treats Messages as Instructions

This vulnerability exposes a critical architectural weakness in AI assistants: they cannot reliably distinguish between user data and attacker instructions when consuming untrusted external content. The attack is uniquely dangerous because it bypasses all traditional mobile security defenses without requiring a malicious app, special permissions, or elevated privileges—just carefully crafted text in a notification. The memory poisoning variant is especially concerning, as false context injected into Gemini's long-term memory can persist and affect users long after the initial attack.