Security researchers have demonstrated that attackers can plant invisible HTML code in emails to silently manipulate the summaries generated by AI assistants, causing users to receive altered information without any warning signs. Forcepoint X-Labs published findings showing how a few lines of concealed HTML can inject hidden commands into an AI email summarizer, effectively making the AI "read" a completely different message than what appears on screen. The research claims it's now possible for users to view one email in their inbox while their AI assistant processes an entirely different version.
In Forcepoint's controlled experiment, researchers embedded an injection payload using standard HTML concealment techniques—specifically styling text with 'font-size:0px; color:#ffffff; line-height:0'—which rendered the malicious instructions invisible in Outlook while passing them intact to the language model. The visible email contained 537 characters, but the summarizer received 1,009 characters, including 472 characters of hidden injection text. When researchers ran both clean and injected versions of the email through their vulnerable setup 10 times each, every single injected attempt succeeded in producing manipulated results. Each compromised summary reported a false invoice deadline of September 3, 2026, replacing the actual August 21, 2026 date, and removed a person's name from the output exactly as the hidden instructions had commanded.
"The test confirmed that the summarizer output was silently hijacked without signalling tampering to the reader," Forcepoint researcher Ben Gibney wrote in a blog post. Gibney noted that the injected instructions weren't a sophisticated jailbreak—they were simply written as direct commands to the summarizer, telling it to accept replacement content as the "authoritative record" and to conceal any mention of the hidden text. When displayed side-by-side, the clean and injected emails appeared virtually identical, with the only noticeable difference being extra whitespace between the final line and the signature—a minor artifact that could have been eliminated with additional effort, according to the researchers.
The vulnerability stems from how untrusted email content is fed to language models without protective measures, rather than from flaws in any specific LLM provider or commercial summarizer. Forcepoint clarified that while their proof-of-concept used Claude-haiku-4-5 to drive the summarizer, the attack isn't directed at Outlook, any named summarizers, or the particular model employed—it represents a systemic risk in systems lacking safeguards between user input and AI processing. The researchers isolated a single email summarizer running an unguarded LLM pipeline with no guardrails separating instructions from email content, allowing the model to treat hidden HTML as legitimate commands rather than data to be summarized.
To defend against such prompt injections, the report recommends extracting only content visible to users, detecting hidden or suspicious HTML and CSS styling, separating email headers from message bodies, treating all email content as untrusted data, and validating AI-generated summaries against the original source. The findings underscore a fundamental challenge as AI assistants become embedded in everyday workflows: without proper input sanitization, these tools can become attack vectors that betray user trust invisibly. Organizations deploying AI summarizers face a choice between convenience and security architecture, while the broader shift toward AI-mediated information may require rethinking how we verify the authenticity of what machines tell us we've received.