Cyber attackers have discovered a new way to manipulate AI-powered email summarizers, using hidden instructions in an email’s HTML code to generate false and potentially malicious information. A recent study by Forcepoint X-Labs demonstrates how this technique, known as indirect prompt injection, can be used to deceive even the most advanced AI systems.
The researchers created a proof-of-concept experiment where they built a lab environment with synthetic data and an Outlook add-in that sent email headers and body text to an LLM-powered summarization service. They then crafted an otherwise normal-looking email containing a malicious prompt hidden in the HTML, making it invisible to the recipient but still present for the AI to process.
The results were alarming: in all 10 runs of the experiment, the AI-generated summaries contained altered information that differed from the original email. For example, the outstanding invoice amount was changed from €8,750 to €46,200, and a quarterly supplier review date was shifted by several weeks. These changes would have gone unnoticed by an actual recipient, who would have relied on the AI’s summary as accurate.
The study highlights the pervasive issue of prompt injection in AI systems. The inability of these systems to distinguish between data they are processing and instructions they are meant to follow is a significant vulnerability. OWASP has consistently ranked prompt injection as one of the top risks for LLM and generative AI applications since 2023.
Ben Gibney, a researcher at Forcepoint X-Labs, emphasizes that this technique is not just limited to email summarizers. Agentic summarizers, which have the ability to send emails, schedule meetings, and perform other actions, would pose even greater security implications if compromised by prompt injection attacks.
The findings of this study are particularly concerning because they demonstrate how easily attackers can manipulate AI systems without being detected. Forcepoint recommends that organizations treat incoming content and AI-generated output as potentially untrusted and implement controls to detect attempts to conceal text through HTML or other formatting.
In light of this study, it is essential for organizations to prioritize the security of their AI-powered tools and services. By treating AI-generated information with a healthy dose of skepticism and implementing robust safeguards, businesses can mitigate the risks associated with prompt injection attacks and protect themselves from potential data breaches and cyber threats. As Gibney notes, “The security implications are bounded to what the summarizer is directed to do,” making it crucial for organizations to take proactive measures to prevent such attacks in the first place.
Source: Dark Reading — 2026-08-25