An Old Trick Pointed at a New Reader
Hidden text is not novel. Setting font size to zero, color to white and line height to nothing has been standard practice in spam and SEO manipulation for twenty years. What changed is who reads it. Hidden text used to target crawlers and filters; now it targets the model reading your mail on your behalf. The human sees a normal 537-character email. The model receives 1,009 characters, and the extra 472 are instructions. The outcome is clean: all ten injected runs produced a manipulated summary. What changed was not phrasing but facts — an invoice deadline moved from August 21 to September 3, 2026, the amount inflated to more than five times the real figure, and a great deal of the original content dropped. The critical part is that the summary looks fine. It still reads as an ordinary summary, with no indication that anything was altered.
The Experimental Conditions Matter
This is a proof of concept, not an incident in the wild, and several conditions should be stated. The environment was an isolated lab with synthetic data, running in a throwaway Microsoft tenant, built for security education. The pipeline used an Outlook add-in that sent email headers and body text to an LLM-powered summarization service using Claude Haiku 4.5 — and Forcepoint states plainly that it was deliberately constructed without guardrails, meaning nothing let the model distinguish "this is email content" from "these are instructions for you." So what this demonstrates is that invisible injection succeeds every time against an unguarded summarization pipeline — not that every AI email summarizer is vulnerable. Whether a real product is depends on whether it implements that separation, which is exactly what you cannot determine from its marketing page.
No Longer Just Theoretical
For context, OWASP has ranked prompt injection first among its Top 10 risks for LLM and generative AI applications since 2023. A separate Forcepoint report found threat actors hiding instructions on ordinary websites, confirming indirect prompt injection is in use against live web infrastructure. One of those attacks specifically targeted the agentic surface — assistants inside IDEs, terminals or DevOps pipelines, where tools like GitHub Copilot, Cursor or Claude Code could ingest a payload while doing research. Forcepoint's mitigation advice is concrete: summarizers should extract only user-visible content, and treat email as untrusted data throughout. Both belong on the review checklist for any product adding a summarization feature — particularly the first, which means the rendering layer has to determine what a human can actually see rather than piping every string in the HTML to the model. For individual users the options are narrower but not zero: for external mail, any actionable detail surfaced in a summary — amounts, account numbers, deadlines — is worth checking against the original before acting on it.