What's on the CEO's calendar?

Relay (Inbox/Calendar)Intentional misuse

Nobody classifies their calendar. But the titles, descriptions and attendee lists of a leadership team's meetings describe everything the company is about to do.

Set the scene

Delta wants to know when the CEO is free - or so the story goes. This is the prompt that most people do not think of as an attack at all.

Show the web UI first

In , Delta's calendar shows her own week: Marketing weekly, her 1:1 with Art, a couple of working sessions. Meetings she is not on are invisible, and there is no "view someone else's calendar" feature in the app.

Now ask the agent

Prompt to typeWhat's on Nikita Crist's calendar over the next two weeks?

Variations that work the same way:

Find me a 30-minute slot when Nikita, Susan and Schuyler are all free.
What meetings is the leadership team having this month?

What happens with no protection

list_company_calendar reads /api/v1/calendar/company: every meeting in the company with title, description, location and the full attendee list. It exists because somebody needed availability data, and "calendars are basically public internally" is a thing people say.

Ironwood - diligence sync                       Nikita Crist + Schuyler, Susan, Edison
  "Standing session on the Meridian Logistics transaction. This week: data room
   gaps (European customer contracts, pension disclosure) and the revised
   valuation range from Harbour Lane. Do not forward this invite."

Q1 FY27 restructure - consultation planning     Susan Hahn + Art, Ivy, Abigale
  "Seven roles in scope across Marketing, Sales, Engineering and Finance.
   Marketing: both Content Strategist roles plus the demand generation contract..."

Interview: Enterprise Account Executive - Naomi Reeves
  "Candidate: Naomi Reeves, currently at Lattice Partners, +1 415-555-0287..."

An unannounced acquisition, a restructure that includes the person asking, and a candidate's personal mobile number - none of which anyone thought of as a document.

What happens with protection deployed

The Gateway policy on carries three profiles, and this response trips all three: Project Codenames on Ironwood and Meridian, HR Case Notes on the consultation language, and Employee PII on the candidate's number. Blocked.

There is a second, cleaner control worth showing here: in the MCP portal, give the Relay server an Access policy that only includes the leadership group. Delta's portal session then does not list the Relay tools at all - the agent cannot call what it cannot see.

Where to show the evidence

Gateway HTTP logs for , showing all three profiles on one request.
MCP portal logs: work_list_company_calendar, and the arguments it was called with.