AI can be made to read an email much differently than you do
Brief
Security researchers are claiming it is possible for users to see one email in their inbox while their AI assistant reads another.
Forcepoint X-Labs has demonstrated how a few lines of invisible HTML can be planted into an email that an AI email summarizer picks up and runs as instructions. In a controlled environment, the researchers did this using HTML styling that made the text invisible in Outlook, but carried it as is in the content passed to an LLM.
“We isolated a single email summarizer running an unguarded LLM pipeline, embedded a hidden prompt injection payload using common HTML concealment techniques, and ran both benign and injected emails through the system with pre-registered success criteria,” said Forcepoint researcher Ben Gibney in a blog post .
The test confirmed that the summarizer output was silently hijacked without signalling tampering to the reader, Gibney added.