Security researchers are claiming it is possible for users to see one email in their inbox while their AI assistant reads another.
Forcepoint X-Labs has demonstrated how a few lines of invisible HTML can be planted into an email that an AI email summarizer picks up and runs as instructions. In a controlled environment, the researchers did this using HTML styling that made the text invisible in Outlook, but carried it as is in the content passed to an LLM.
“We isolated a single email summarizer running an unguarded LLM pipeline, embedded a hidden prompt injection payload using common HTML concealment techniques, and ran both benign and injected emails through the system with pre-registered su...