With some simple HTML that's invisible to users, attackers can manipulate AI-powered email summarizers into producing malicious information.
August 25, 2026
A new study has shown how attackers can use hidden instructions in an email to manipulate AI assistants into generating false and potentially dangerous summaries for recipients.
The study, by researchers at Forcepoint X-Labs, is the latest example of how attackers can use indirect prompt injections to subvert AI systems and get them to behave in unintended ways when processing external content.
Multiple researchers have demonstrated variations of the issue, which stems from the inability of AI systems to reliably distinguish between data they are processing and instructions they are meant to follow. The problem is so pervasive that OWASP has consistently ranked prompt injection No. 1 in its list of Top 10 risks for LLM and generative AI applications since 2023.
