Your AI email assistant can be fed a fake message while you read a real one

Key points

• Forcepoint X-Labs researchers hid 472 characters of invisible commands inside an email and successfully tricked an AI summariser into altering its output in all 10 of 10 test runs.
• The hidden text was made invisible to the human reader using basic HTML styling tricks, but the AI received and acted on every word.
• The manipulated summaries reported a false invoice deadline of 3 September 2026, replacing the real date of 21 August 2026, and silently dropped a named contact from the output.
• No specific AI product or email platform is to blame: the researchers say the risk is built into any system that feeds unfiltered email content directly to an AI without checks.
• Forcepoint recommends stripping hidden HTML before passing email content to any AI tool.

A security research team has shown that AI-powered email summarisers, the tools built into some email apps to give you a quick digest of a long message, can be secretly hijacked to show you something that was never in the original email.

Forcepoint X-Labs published the findings in a blog post this week, also covered by CSO Online. The technique is a form of what researchers call prompt injection: hiding instructions inside content that an AI will process, so the AI follows the attacker's commands instead of doing its intended job.

How did the hidden message work?

The email looked normal. The trick was in the HTML code underneath it.

HTML is the formatting language that tells your email app how to display a message, controlling things like font size and colour. The researchers used basic HTML styling to make text invisible on screen: they set the font size to zero, the text colour to white (so it vanished against a white background), and the line height to zero. To anyone reading the email in Microsoft Outlook, it looked clean.

The AI summariser, however, did not render the email visually. It read the raw text, hidden words and all.

The visible email contained 537 characters. The text passed to the AI contained 1,009 characters, including 472 characters of secret instructions the human reader never saw.

Those instructions told the summariser to treat a fake version of the email as the "authoritative record" and to stay quiet about the substitution.

What did the fake summaries say?

Every single one of the 10 test runs produced the manipulated result.

The real email mentioned an invoice deadline of 21 August 2026 and named a contact called Diego Siciliani. The AI summaries, following the hidden instructions, reported the deadline as 3 September 2026 and dropped Siciliani's name entirely.

A reader trusting the AI digest would have walked away with the wrong deadline and a missing contact, with no indication anything was wrong.

The AI model used in the tests was Claude claude-haiku-4-5, made by Anthropic. Forcepoint is clear that this is not a flaw specific to that model. The same result would likely follow in any system that passes raw, unfiltered email straight to an AI without separating the trusted instructions from the untrusted content.

Should people who use AI email tools be worried?

Yes, with a caveat: this is a proof-of-concept, meaning it was demonstrated in a controlled lab setup, not observed in a real attack in the wild.

But the technique requires no advanced skill. The researchers described the hidden instructions as straightforward commands, not an elaborate workaround. Any criminal who understands basic HTML could attempt it.

Forcepoint recommends that organisations building or deploying AI email tools take four practical steps: extract only the text a human can actually see before sending it to the AI; scan for hidden or suspicious HTML styling; keep email header information separate from the message body when constructing AI prompts; and cross-check AI-generated summaries against the source email before acting on them.