Your AI email assistant can be fed a fake message while you read a real one
Researchers hid nearly 500 characters of secret instructions inside an ordinary-looking email. The AI summariser obeyed them every single time.
Key points
- Forcepoint X-Labs researchers hid 472 characters of invisible commands inside an email and successfully tricked an AI summariser into altering its output in all 10 of 10 test runs.
- Basic HTML styling made the hidden text invisible to any human reader, but the AI received and acted on every word.
- Manipulated summaries reported a false invoice deadline of 3 September 2026, replacing the real date of 21 August 2026, and silently dropped a named contact.
- No specific AI product or email platform is to blame: the risk lives in any system that feeds unfiltered email content directly to an AI without checks.
- Forcepoint recommends stripping hidden HTML before passing email content to any AI tool.
A security research team has shown that AI-powered email summarisers, the tools built into some email apps to give you a quick digest of a long message, can be secretly hijacked to show you something that was never in the original email.
Forcepoint X-Labs published the findings in a blog post this week, also covered by CSO Online. The technique is a form of what researchers call prompt injection: hiding instructions inside content an AI will process, so the AI follows the attacker's commands instead of doing its intended job. It's a problem we've been tracking closely; our 4 August story "Your Email AI Assistant Could Be Turned Against You, Researchers Warn" documented how hijacked email AI could impersonate colleagues and set up financial fraud without a single suspicious link.
How did the hidden message work?
The email looked clean. Underneath it, the HTML told a different story.
HTML is the formatting language that tells your email app how to display a message, controlling things like font size and colour. The researchers used styling to make text invisible: font size set to zero, text colour white against a white background, line height zero. Anyone reading the email in Microsoft Outlook saw nothing unusual.
The AI summariser didn't render the email visually. It read the raw text, hidden instructions included.
The visible email contained 537 characters. What the AI actually received contained 1,009 characters, with 472 of them being secret instructions no human would ever see. Those instructions told the summariser to treat a fake version of the email as the "authoritative record" and stay quiet about the substitution.
What did the fake summaries say?
Every one of the 10 test runs produced the manipulated result.
The real email mentioned an invoice deadline of 21 August 2026 and named a contact called Diego Siciliani. Guided by the hidden instructions, the AI summaries reported the deadline as 3 September 2026 and dropped Siciliani's name entirely. A reader trusting the digest would have walked away with the wrong deadline and a missing contact, with no indication anything was wrong.
The model used in testing was Claude haiku-4-5, made by Anthropic. Forcepoint is clear this isn't a flaw specific to that model. As researcher Ben Gibney wrote in the blog post, "The attack is not against Outlook, any named summarizers, or the model used to drive the summarizer." The vulnerability sits in the pipeline design, not the AI itself.
| Detail | Value |
|---|---|
| Hidden characters injected | 472 |
| Total characters sent to AI | 1,009 |
| Visible characters in email | 537 |
| Injected runs that succeeded | 10 out of 10 |
| Fake deadline shown | 3 September 2026 |
| Real deadline in email | 21 August 2026 |
Should people who use AI email tools be worried?
Yes, with a caveat: this is a proof-of-concept demonstrated in a controlled lab setup, not an observed attack in the wild.
But it doesn't require advanced skill. Gibney described the hidden instructions as straightforward commands, not an elaborate jailbreak. Anyone who understands basic HTML could attempt this. The uncomfortable reality for organisations is that most AI email summarisers were built for convenience, not adversarial conditions, and the gap between those two design goals is exactly where this attack lives.
Forcepoint's recommended fixes are practical: extract only the text a human can actually see before passing it to the AI, scan for suspicious HTML styling, keep email headers separate from the message body in AI prompts, and cross-check AI summaries against the source email before acting on them.
