Hidden HTML Prompt Injection Can Manipulate AI Email Summaries, Researchers Show
Summary
Forcepoint researchers demonstrated that hidden HTML instructions in an email can cause an AI summarizer to omit facts and fabricate details. Experts say the risk is real, though evidence of widespread in-the-wild use remains limited.
Key points
- Researchers embedded indirect prompt-injection instructions in email text hidden with zero-size, white-on-white, and zero-line-height HTML styling.
- In the lab test, 472 of the 1,009 characters sent to the summarizer were hidden from readers.
- The resulting summaries followed the hidden instructions, omitted legitimate information, and presented fabricated details without warning readers.
- The attack relies on a service automatically passing external content to an LLM; the attacker does not need direct access to the model.
- Experts said indirect prompt injection is a known risk, but evidence of routine, large-scale email attacks remains limited.
- Suggested defenses include detecting hidden or suspiciously styled content before it reaches an LLM and monitoring AI agents’ actions.
Article Details
- Event Type
- Researchers demonstrated an indirect prompt-injection attack that uses hidden HTML in an email to alter an AI summarizer’s output.
- Impact
- The attack produced summaries containing fabricated information and omitting facts, without warning readers that the source email contained hidden instructions. This could lead to manipulated decisions; consequences could be more serious if an AI system can access sensitive data or take actions. Broad, routine exploitation in the wild was not established.
People
Ben GibneyForcepoint X-Labs security researcher who described the research and its findings.Erich KronCISO advisor at KnowBe4; recommended inspecting outside input and monitoring agent actions.Jacob KrellSenior director for secure AI solutions and cybersecurity at Suzu Labs; commented on techniques for hiding content from people or confusing scanners.Johann RehbergerDemonstrated indirect prompt-injection attacks against Microsoft 365 Copilot using attacker-controlled email and documents, according to Steve Wilson.John BambenekPresident of Bambenek Consulting; commented on indirect prompt injection and the social-engineering risks of acting on email summaries.John StrandPrincipal at Black Hills Information Security; commented on the risk of injected content being treated as authoritative by people or AI agents.Noelle MurataSenior security engineer at Xcape; said prompt injection should be treated as an authorization problem.Scott MiserendinoCTO at DataBee; commented on indirect prompts being delivered through services that automatically send content to an LLM.Steve WilsonFounder and co-chair of the OWASP GenAI Security Project; discussed indirect prompt injection, its potential impact, and evidence of exploitation.Waseem AhmedHead of engineering at Secure.com; commented on the risks of fabricated and omitted information in AI summaries.
Products
Microsoft 365 CopilotWilson noted that in 2024, Johann Rehberger demonstrated indirect prompt-injection attacks against Microsoft 365 Copilot using attacker-controlled email and documents, including techniques for hiding instructions fromPrompt Shieldsreader. “Microsoft itself was using almost exactly this email-summarizer scenario when it introduced Prompt Shields for indirect prompt injection in 2024,” he added. “Similar attacks have subsequently been