# Another Day, Another AI Prompt Injection - Threat Wire Source: https://www.youtube.com/watch?v=6QYGqm5Gwu0 Recap page: https://rapidrecap.app/video/6QYGqm5Gwu0 Generated: 2025-08-20T19:02:27.973+00:00 --- ## Quick Overview The video discusses a new "Prompt Injection" vulnerability affecting Google's Gemini AI, allowing attackers to hijack conversations or extract sensitive information by embedding malicious commands into calendar invites or other data. It also touches upon the ineffectiveness of current phishing training methods and a Salesforce data breach. **Key Points:** - A "Prompt Injection" vulnerability has been found in Google's Gemini AI, allowing attackers to manipulate its behavior via crafted calendar invites. - Research presented at Black Hat USA 2025 suggests traditional anti-phishing training and embedded phishing simulations have limited effectiveness. - A significant Salesforce data breach, linked to the "ShinyHunters" group, has impacted major companies like Qantas, LVMH, and Adidas. - The Salesforce breach involved voice phishing and social engineering to steal data from CRM instances. - Google itself was affected by the Salesforce breach, leading to updates in its file access protocols to prevent future attacks. - Microsoft is updating its M365 security settings to disable certain file access protocols by default, starting July 2025. - Hack Five has released a new product, the "pineapple bee-per," designed for various functionalities. ![Screenshot at 00:06: The "THREAT WIRE" title card, introducing the cybersecurity news segment that covers AI vulnerabilities and data breaches.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-06.png) **Context:** This video from "Threat Wire" covers recent cybersecurity threats and vulnerabilities. It begins by discussing a prompt injection flaw in Google's Gemini AI, then shifts to the questionable effectiveness of current employee phishing training, and finally addresses a major data breach at Salesforce attributed to the "ShinyHunters" group. The content highlights the evolving landscape of cyber threats and the challenges organizations face in protecting sensitive data. ## Detailed Analysis The "Threat Wire" video details a newly discovered "Prompt Injection" vulnerability that targets Google's Gemini AI. This exploit allows attackers to manipulate Gemini's behavior, potentially hijacking conversations, extracting sensitive information, or controlling other AI agents. The vulnerability is demonstrated by crafting malicious calendar invites that, when processed by Gemini, can execute harmful commands. The video also briefly mentions research from Black Hat USA 2025 that found traditional anti-phishing training and embedded phishing simulations to be largely ineffective in preventing users from falling for phishing attempts. Furthermore, it highlights a significant Salesforce data breach attributed to the "ShinyHunters" group, which used voice phishing and social engineering tactics to steal data from Salesforce CRM instances, impacting major companies like Qantas, LVMH, and Adidas. The segment concludes with a mention of Hack Five releasing a pineapple bee-per, a device that can be used for various tasks, including potentially malicious ones. ### AI Vulnerabilities - "Prompt Injection" vulnerability in Google Gemini AI - Malicious commands embedded in calendar invites - Potential for hijacking conversations and data extraction ### Cybersecurity Research - Ineffective phishing training methods - Low success rate in preventing phishing attempts - "ShinyHunters" Salesforce data breach impacting major companies ### New Product Release - Hack Five releases pineapple bee-per - Device used for various tasks, including potential malicious uses ![Screenshot at 00:02: Host introducing the topic of the "Prompt Injection" vulnerability in AI.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-02.png) ![Screenshot at 00:04: Visual glitch effect indicating a security threat or vulnerability.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-04.png) ![Screenshot at 00:05: Graphic displaying an eagle emblem with "Internet Freedom" and a globe, possibly representing a cyber-security theme.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-05.png) ![Screenshot at 00:06: Title card for "THREAT WIRE" with a world map background.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-06.png) ![Screenshot at 00:11: Text overlay: "Google Calendar + AI Hijack".](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-11.png) ![Screenshot at 00:33: Screenshot of a research paper titled "Invitation Is All You Need: Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite".](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-00-33.png) ![Screenshot at 01:45: Abstract of the research paper detailing the prompt injection vulnerability.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-01-45.png) ![Screenshot at 02:00: Title overlay: "Is Phishing Training Worth It?".](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-02-00.png) ![Screenshot at 02:37: Quote from a research study stating that anti-phishing benefits from training are limited.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-02-37.png) ![Screenshot at 03:11: Title overlay: "Salesforce Data Theft Is Affecting Everyone". A report about a Salesforce data breach is shown in the background montage indicating the severity of the issue and its widespread impact on various companies including Google, LVMH, and Adidas. The report mentions that attackers are using voice phishing and social engineering to steal data from Salesforce CRM instances, and that Google itself was affected by this breach, leading to updates in their file access protocols to prevent future attacks by disabling certain file access protocols by default. This implies a significant security risk for businesses relying on Salesforce and Microsoft 365. The attackers, identified as ShinyHunters, are also linked to previous attacks on major brands like Adidas and LVMH. The updates are being rolled out starting July 2025, with full implementation expected by August 2025, impacting the Salesforce data loader and potentially disabling FTP and HTTP file access by default. The report also highlights that the threat actors are likely the same group responsible for the Snowflake data breaches from the previous year. This indicates a persistent and evolving threat landscape for cloud-based data storage and CRM systems, necessitating vigilant security practices and prompt adoption of updated security measures from service providers like Microsoft and Salesforce to protect user data from unauthorized access and theft, and to mitigate the impact of such breaches on businesses and their customers globally, ensuring data integrity and customer trust in digital platforms and services, especially concerning sensitive business and customer information handled by platforms like Salesforce and Microsoft 365 which are critical for daily operations and business continuity in the modern digital economy and globalized marketplace, emphasizing the need for continuous monitoring and proactive defense strategies against sophisticated cyber threats and malicious actors in the cybersecurity domain and the broader digital ecosystem.](https://ss.rapidrecap.app/screens/6QYGqm5Gwu0/00-03-11.png)