A Single Notification Could Hijack Gemini on Android

A poisoned notification was all it took.

Researchers have demonstrated that a single hostile message arriving through WhatsApp, Slack, SMS, Signal, Instagram or Messenger could hijack Google Gemini's voice assistant on Android, turning routine alerts into a launchpad for prompt-injection attacks. The victim never had to install anything. The assistant simply had to read the notification.

The attack abuses how Gemini ingests context. Notifications surface on the lock screen and in the assistant's awareness. When Gemini treats the text of a notification as instructions rather than data, an attacker who can deliver a message can also deliver commands.

The demonstrated impacts are not subtle.

Researchers showed the assistant opening connected windows on the device, fabricating a message that appeared to come from the victim's boss, dialing the phone into a Zoom call, and — most worryingly — writing instructions into Gemini's long-term memory so the compromise persisted across sessions.

That last technique is the one to watch. Memory poisoning means a single malicious notification, opened once, could shape the assistant's behavior on future, unrelated prompts. The user sees nothing obviously wrong. The assistant has been quietly retrained on hostile input.

The delivery surface is enormous. Any channel that produces an Android notification Gemini can read becomes an injection vector. That includes work tools like Slack, where an attacker only needs to be in a shared workspace or send a direct message. It includes SMS, which requires nothing more than a phone number. It includes encrypted messengers, where the payload rides inside otherwise legitimate end-to-end traffic.

No elevated permissions. No sideloaded APK. No phishing click.

The class of issue is by now familiar to anyone tracking LLM security: indirect prompt injection, where untrusted content the model processes ends up steering the model's actions. What makes the Android notification case sharper is the proximity to real device capabilities — calls, memory, app windows — and the fact that the trigger is a passive read of inbound text.

Guidance from the research is straightforward for users in the interim: review what Gemini is allowed to do with notifications, prune the apps the assistant can act on, and audit any saved memories for entries you did not create. Enterprise admins managing Android fleets should treat assistant-notification integration as a configuration question, not a default.

Google's broader posture on prompt-injection mitigations is published on its security research blog, and Gemini's data and permission controls live in the assistant's settings on-device.

The bigger lesson is structural. Assistants that fuse messaging, memory and action expand the blast radius of any one bad input. The notification tray, long treated as a low-trust surface, is now an instruction channel.