From Dumbledore to Delayed Tool Invocation w/ Ben Nassi

A simple ״thank you״ triggered the attack. In episode 3, Michael Bargury welcomes back Ben Nassi (Tel Aviv University faculty member) to revisit Invitation Is All You Need, his research with Stav Cohen and Or Yair. In their demonstration, a user asked Google Assistant about their calendar, bringing a malicious invitation into the conversation. When they thanked the assistant, the payload ran: opening real windows and switching on a boiler. Michael and Ben unpack delayed tool invocation: why making an attack wait for a later response can help it evade defenses and trigger actions the user never requested. They debate whether that counts as “zero-click,” what changes when agents run without a user prompting them, and why blocking dangerous actions can also block useful ones. In the Wild is hosted by Zenity Co-Founder & CTO Michael Bargury. A Zenity Labs podcast, produced by POLDHU CHAPTERS 00:00 A prompt injection opens real windows 00:47 Ben Nassi and the Dumbledore opener 02:22 Invitation Is All You Need 06:46 Google's response and defenses 10:32 Delayed tool invocation 17:44 CaMeL and the cost of defenses 24:45 Beyond the lethal trifecta 30:07 Zero-click or half-click? 37:58 Black Hat submissions and great talks 50:34 Real World AI Security Relevant Profiles: Ben Nassi https://x.com/ben_nassi https://www.linkedin.com/in/ben-nassi-phd-68a743115/ Michael Bargury https://x.com/mbrg0 https://www.linkedin.com/in/michaelbargury/ Stav Cohen https://x.com/StAJect0r https://www.linkedin.com/in/staject0r/ Or Yair https://x.com/oryair1999 https://www.linkedin.com/in/or-yair/ Zenity Labs https://x.com/zenitysec_labs https://www.linkedin.com/showcase/zenity-sec-labs/ https://labs.zenity.io/ Mentions: Johann Rehberger — Delayed Tool Invocation Credited as the original discoverer of the technique that underpins Ben's conditional prompts work. His blog covers it across multiple posts → embracethered.com: https://embracethered.com/blog/ Simon Willison — "The Lethal Trifecta" Ben extends it from three conditions to four, adding physical actuation → simonwillison.net: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ Charlie Miller and Chris Valasek — Jeep Cherokee Remote Exploitation (DEF CON 23 / Black Hat 2015) → DEF CON talk (YouTube): https://www.youtube.com/watch?v=OobLb1McxnI The Real World AI Security Conference: https://seclab.stanford.edu/RealWorldAIsec/ Dumbledore - Full name Albus Percival Wulfric Brian Dumbledore, headmaster of Hogwarts School of Witchcraft and Wizardry ;) Research: "Invitation Is All You Need" (Gemini zero-click attack, with Stav Cohen and Or Yair) The core research of this episode. Calendar invite embeds a prompt injection that hijacks Google Assistant, triggers physical IoT control, video streaming, and email exfiltration. → Paper site: https://sites.google.com/view/invitation-is-all-you-need/home → arXiv preprint: https://arxiv.org/abs/2508.12175 → SafeBreach writeup: https://www.safebreach.com/blog/invitation-is-all-you-need-hacking-gemini/ "Here Comes the AI Worm" / Morris-II (with Stav Cohen and Ron Bitton) The first AI worm, referenced when Ben discusses how the zero-click term originated. Self-replicating adversarial prompts targeting RAG-based GenAI ecosystems. → arXiv: https://arxiv.org/abs/2403.02817 → Project site: https://sites.google.com/view/compromptmized CaMeL — "Defeating Prompt Injections by Design" (Google DeepMind + ETH Zurich) Ben's main criticism: great for single inference, breaks down in multi-turn/agent scenarios. The mitigation Michael asks about. → arXiv: https://arxiv.org/abs/2503.18813 → GitHub: https://github.com/google-research/camel-prompt-injection → Simon Willison's analysis: https://simonwillison.net/2025/Apr/11/camel/ "The Promptware Kill Chain" (with Bruce Schneier, Oleg Brodt, Elad Feldman) Referenced by Michael when asking about canaries and prompt perturbation. Maps prompt injection attacks onto a seven-stage malware kill chain. → arXiv: https://arxiv.org/abs/2601.09625 → Lawfare: https://www.lawfaremedia.org/article/the-promptware-kill-chain → Schneier on Security: https://www.schneier.com/essays/archives/2026/02/the-promptware-kill-chain.html