Invisible Text in an Email Fooled an AI Summarizer in All 10 Runs
Forcepoint hid instructions in an email using white text at zero font size. The reader saw nothing unusual. The AI summary reported a fake invoice of EUR 46,200 and a fake deadline, every single time.
Security researchers at Forcepoint built a small AI email summarizer, the kind of tool that sits in your inbox and gives you a two line version of a long message. Then they sent it an email with instructions hidden inside. The reader saw a normal invoice reminder. The AI read something else entirely, and produced a summary with the wrong amount, the wrong deadline and a missing name. In ten out of ten runs.
The trick is almost boringly simple. The attacker wrapped a paragraph of plain English instructions in HTML styled with font-size:0px; color:#ffffff; line-height:0. White text, zero height, invisible in Outlook. But the styling only affects what your eyes see. The raw text still travels with the message, and the summarizer was fed the raw text. Of the 1,009 characters passed to the model, 537 were visible to the human and 472 were the hidden injection.
The results were measured properly, with the pass and fail criteria written down before the runs started. The clean email produced the correct summary all ten times. The injected email named a fake invoice amount of EUR 46,200 and a fake deadline of 3 September ten times out of ten, while dropping the real deadline and the real contact name every time. The hidden instructions also told the model not to mention the notice, and it obeyed: not one summary hinted that anything had been tampered with. The summarizer ran on claude-haiku-4-5, and Forcepoint expects the same outcome from any model in a pipeline built this loosely.
What’s actually going on here: this is indirect prompt injection, a problem Simon Willison named back in 2022 and one that sits at the top of the OWASP risk list for language models. A language model has no reliable way to tell the difference between “content I should summarize” and “instructions I should follow”. It just sees one long block of text. When you paste an email, a web page or a PDF into a model, anything written in there gets a vote on what the model does next. Forcepoint deliberately built the most vulnerable version possible, with no guardrails, no separation between the email headers and the body, and a one line system prompt. That is the point of the experiment: it shows what happens when nobody thought about it, which describes a lot of quickly built AI features.
What this means for you: if you use an AI summary feature for email, treat the summary as a convenience, not as a record. Before you pay an invoice, agree to a deadline or forward something on, open the original message and read the numbers yourself. That single habit defeats this entire attack. If you build these tools, the fixes are known: pass the model only the text actually shown to the user, keep headers and body separate, flag anything retrieved from outside as untrusted, and never let a summarizer take actions on a mailbox. Worth knowing that this was one message, one model, ten runs at temperature zero, so it is a clean demonstration rather than a measurement of how common the attack is in the wild. Forcepoint has separately found real injection payloads out there, so it is not hypothetical either.
Sources
Source: https://www.forcepoint.com/blog/x-labs/html-payload-hijacks-email-summarizer
80 British Performers Ask for One Thing: Legal Ownership of Their Own Voice
Actors and musicians including Hugh Bonneville and Nicola Coughlan want voice added to statutory rights in the UK, the way a name or image already is. The campaign cites 28 percent of UK adults targeted by voice-cloning scams.
